[Paper Review] Get Your Workload in Order: Game Theoretic Prioritization of Database Auditing

Chao Yan, Bo Li+4 more|arXiv (Cornell University)|Jan 22, 2018

Network Security and Intrusion Detection37 references3 citations

TL;DR

This paper proposes a game-theoretic framework for prioritizing database audit alerts by modeling the interaction between auditors and strategic attackers as a Stackelberg game. It uses linear programming with column generation and heuristic search to derive optimal, randomized auditing policies that significantly outperform non-game-theoretic baselines in reducing alert overload while accounting for adversarial behavior.

ABSTRACT

For enhancing the privacy protections of databases, where the increasing amount of detailed personal data is stored and processed, multiple mechanisms have been developed, such as audit logging and alert triggers, which notify administrators about suspicious activities; however, the two main limitations in common are: 1) the volume of such alerts is often substantially greater than the capabilities of resource-constrained organizations, and 2) strategic attackers may disguise their actions or carefully choosing which records they touch, making incompetent the statistical detection models. For solving them, we introduce a novel approach to database auditing that explicitly accounts for adversarial behavior by 1) prioritizing the order in which types of alerts are investigated and 2) providing an upper bound on how much resource to allocate for each type. We model the interaction between a database auditor and potential attackers as a Stackelberg game in which the auditor chooses an auditing policy and attackers choose which records to target. A corresponding approach combining linear programming, column generation, and heuristic search is proposed to derive an auditing policy. For testing the policy-searching performance, a publicly available credit card application dataset are adopted, on which it shows that our methods produce high-quality mixed strategies as database audit policies, and our general approach significantly outperforms non-game-theoretic baselines.

Motivation & Objective

• Address the critical challenge of alert overload in database auditing, where legitimate alerts vastly outnumber available auditing resources.
• Model the strategic interaction between auditors and potential attackers as a Stackelberg game to reflect real-world adversarial behavior.
• Develop a scalable, computationally efficient auditing policy that prioritizes alert types based on risk and attacker incentives.
• Provide a theoretical foundation with NP-hardness results and a practical solution using linear programming and column generation.
• Evaluate the framework on real-world datasets, including electronic medical records and credit card applications, to demonstrate practical effectiveness.

Proposed method

• Model the database auditing problem as a Stackelberg game where the auditor commits to a randomized auditing policy and attackers respond by choosing which records to target.
• Formulate the auditor's problem as a bilevel optimization to maximize expected utility under strategic attacker responses.
• Use column generation to iteratively construct high-quality auditing policies, avoiding the exponential complexity of full policy enumeration.
• Integrate heuristic search to refine solutions and improve convergence, especially in large-scale settings with many alert types.
• Apply linear programming to solve the relaxed master problem at each iteration, ensuring computational tractability.
• Derive upper bounds on resource allocation per alert type to enforce operational constraints in real-world deployments.

Experimental results

Research questions

• RQ1 How can auditing policies be prioritized to maximize detection of strategic, resource-constrained attackers in the face of alert overload?
• RQ2 What is the computational complexity of the optimal auditing policy selection under strategic attacker behavior?
• RQ3 How does the proposed game-theoretic approach compare to non-game-theoretic baselines in terms of detection performance and resource efficiency?
• RQ4 To what extent does the framework scale to real-world workloads with high-variance alert counts and multiple potential attackers?
• RQ5 How sensitive is the performance of the proposed policy to variations in attacker rationality and parameter assumptions?

Key findings

• The constrained version of the database auditing problem is NP-Hard, establishing the theoretical intractability of finding optimal policies without approximation.
• The proposed method using column generation and linear programming achieves high-quality mixed strategies that closely approximate the optimal solution in synthetic evaluations.
• On the Vanderbilt University Medical Center EMR dataset, the framework reduced alert overload by prioritizing high-risk alert types, significantly improving audit efficiency.
• In the credit card application dataset, the game-theoretic policy outperformed non-game-theoretic baselines in detecting suspicious access patterns with fewer false positives.
• The approach demonstrated robustness across varying alert volumes and demonstrated superior performance in detecting stealthy, low-volume attacks that evade traditional alerting.
• The framework effectively handles stochastic alert counts and multiple potential attackers, outperforming models that assume known, fixed alert frequencies.