An Extensible Framework for Detecting Database Security Flaws

Knowing flaws existing in a database security system is very useful for database protection. Database security flaws come from various sources, not only from network, database management systems, but also from the way an administrator manages a database system. Even then, to the best of our knowledge, existing researches for detecting security flaws mostly focus on the network environment, but database security systems. In this paper, we propose a framework for detecting database security flaws. The proposed framework is extensible and can be adapted to explore security flaws in any database systems. Notably, with this framework we can easily define a new potential database security flaw and an effective method to probe and verify it. The prototype and experimental results with Oracle will confirm our approach’s effectiveness and efficiency.