\documentclass[11pt,twoside]{article}\makeatletter

\IfFileExists{xcolor.sty}%
  {\RequirePackage{xcolor}}%
  {\RequirePackage{color}}
\usepackage{colortbl}
\usepackage{wrapfig}
\usepackage{ifxetex}
\ifxetex
  \usepackage{fontspec}
  \usepackage{xunicode}
  \catcode`⃥=\active \def⃥{\textbackslash}
  \catcode`❴=\active \def❴{\{}
  \catcode`❵=\active \def❵{\}}
  \def\textJapanese{\fontspec{Noto Sans CJK JP}}
  \def\textChinese{\fontspec{Noto Sans CJK SC}}
  \def\textKorean{\fontspec{Noto Sans CJK KR}}
  \setmonofont{DejaVu Sans Mono}
  
\else
  \IfFileExists{utf8x.def}%
   {\usepackage[utf8x]{inputenc}
      \PrerenderUnicode{–}
    }%
   {\usepackage[utf8]{inputenc}}
  \usepackage[english]{babel}
  \usepackage[T1]{fontenc}
  \usepackage{float}
  \usepackage[]{ucs}
  \uc@dclc{8421}{default}{\textbackslash }
  \uc@dclc{10100}{default}{\{}
  \uc@dclc{10101}{default}{\}}
  \uc@dclc{8491}{default}{\AA{}}
  \uc@dclc{8239}{default}{\,}
  \uc@dclc{20154}{default}{ }
  \uc@dclc{10148}{default}{>}
  \def\textschwa{\rotatebox{-90}{e}}
  \def\textJapanese{}
  \def\textChinese{}
  \IfFileExists{tipa.sty}{\usepackage{tipa}}{}
\fi
\def\exampleFont{\ttfamily\small}
\DeclareTextSymbol{\textpi}{OML}{25}
\usepackage{relsize}
\RequirePackage{array}
\def\@testpach{\@chclass
 \ifnum \@lastchclass=6 \@ne \@chnum \@ne \else
  \ifnum \@lastchclass=7 5 \else
   \ifnum \@lastchclass=8 \tw@ \else
    \ifnum \@lastchclass=9 \thr@@
   \else \z@
   \ifnum \@lastchclass = 10 \else
   \edef\@nextchar{\expandafter\string\@nextchar}%
   \@chnum
   \if \@nextchar c\z@ \else
    \if \@nextchar l\@ne \else
     \if \@nextchar r\tw@ \else
   \z@ \@chclass
   \if\@nextchar |\@ne \else
    \if \@nextchar !6 \else
     \if \@nextchar @7 \else
      \if \@nextchar (8 \else
       \if \@nextchar )9 \else
  10
  \@chnum
  \if \@nextchar m\thr@@\else
   \if \@nextchar p4 \else
    \if \@nextchar b5 \else
   \z@ \@chclass \z@ \@preamerr \z@ \fi \fi \fi \fi
   \fi \fi  \fi  \fi  \fi  \fi  \fi \fi \fi \fi \fi \fi}
\gdef\arraybackslash{\let\\=\@arraycr}
\def\@textsubscript#1{{\m@th\ensuremath{_{\mbox{\fontsize\sf@size\z@#1}}}}}
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\def\abbr{}
\def\corr{}
\def\expan{}
\def\gap{}
\def\orig{}
\def\reg{}
\def\ref{}
\def\sic{}
\def\persName{}\def\name{}
\def\placeName{}
\def\orgName{}
\def\textcal#1{{\fontspec{Lucida Calligraphy}#1}}
\def\textgothic#1{{\fontspec{Lucida Blackletter}#1}}
\def\textlarge#1{{\large #1}}
\def\textoverbar#1{\ensuremath{\overline{#1}}}
\def\textquoted#1{‘#1’}
\def\textsmall#1{{\small #1}}
\def\textsubscript#1{\@textsubscript{\selectfont#1}}
\def\textxi{\ensuremath{\xi}}
\def\titlem{\itshape}
\newenvironment{biblfree}{}{\ifvmode\par\fi }
\newenvironment{bibl}{}{}
\newenvironment{byline}{\vskip6pt\itshape\fontsize{16pt}{18pt}\selectfont}{\par }
\newenvironment{citbibl}{}{\ifvmode\par\fi }
\newenvironment{docAuthor}{\ifvmode\vskip4pt\fontsize{16pt}{18pt}\selectfont\fi\itshape}{\ifvmode\par\fi }
\newenvironment{docDate}{}{\ifvmode\par\fi }
\newenvironment{docImprint}{\vskip 6pt}{\ifvmode\par\fi }
\newenvironment{docTitle}{\vskip6pt\bfseries\fontsize{22pt}{25pt}\selectfont}{\par }
\newenvironment{msHead}{\vskip 6pt}{\par}
\newenvironment{msItem}{\vskip 6pt}{\par}
\newenvironment{rubric}{}{}
\newenvironment{titlePart}{}{\par }

\newcolumntype{L}[1]{){\raggedright\arraybackslash}p{#1}}
\newcolumntype{C}[1]{){\centering\arraybackslash}p{#1}}
\newcolumntype{R}[1]{){\raggedleft\arraybackslash}p{#1}}
\newcolumntype{P}[1]{){\arraybackslash}p{#1}}
\newcolumntype{B}[1]{){\arraybackslash}b{#1}}
\newcolumntype{M}[1]{){\arraybackslash}m{#1}}
\definecolor{label}{gray}{0.75}
\def\unusedattribute#1{\sout{\textcolor{label}{#1}}}
\DeclareRobustCommand*{\xref}{\hyper@normalise\xref@}
\def\xref@#1#2{\hyper@linkurl{#2}{#1}}
\begingroup
\catcode`\_=\active
\gdef_#1{\ensuremath{\sb{\mathrm{#1}}}}
\endgroup
\mathcode`\_=\string"8000
\catcode`\_=12\relax

\usepackage[a4paper,twoside,lmargin=1in,rmargin=1in,tmargin=1in,bmargin=1in,marginparwidth=0.75in]{geometry}
\usepackage{framed}

\definecolor{shadecolor}{gray}{0.95}
\usepackage{longtable}
\usepackage[normalem]{ulem}
\usepackage{fancyvrb}
\usepackage{fancyhdr}
\usepackage{graphicx}
\usepackage{marginnote}

\renewcommand{\@cite}[1]{#1}


\renewcommand*{\marginfont}{\itshape\footnotesize}

\def\Gin@extensions{.pdf,.png,.jpg,.mps,.tif}

  \pagestyle{fancy}

\usepackage[pdftitle={A Review of Security Mechanisms for Detection of Malicious Transactions in Database},
 pdfauthor={}]{hyperref}
\hyperbaseurl{}

	 \paperwidth210mm
	 \paperheight297mm
              
\def\@pnumwidth{1.55em}
\def\@tocrmarg {2.55em}
\def\@dotsep{4.5}
\setcounter{tocdepth}{3}
\clubpenalty=8000
\emergencystretch 3em
\hbadness=4000
\hyphenpenalty=400
\pretolerance=750
\tolerance=2000
\vbadness=4000
\widowpenalty=10000

\renewcommand\section{\@startsection {section}{1}{\z@}%
     {-1.75ex \@plus -0.5ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large\bfseries}}
\renewcommand\subsection{\@startsection{subsection}{2}{\z@}%
     {-1.75ex\@plus -0.5ex \@minus- .2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\Large}}
\renewcommand\subsubsection{\@startsection{subsubsection}{3}{\z@}%
     {-1.5ex\@plus -0.35ex \@minus -.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\large}}
\renewcommand\paragraph{\@startsection{paragraph}{4}{\z@}%
     {-1ex \@plus-0.35ex \@minus -0.2ex}%
     {0.5ex \@plus .2ex}%
     {\reset@font\normalsize}}
\renewcommand\subparagraph{\@startsection{subparagraph}{5}{\parindent}%
     {1.5ex \@plus1ex \@minus .2ex}%
     {-1em}%
     {\reset@font\normalsize\bfseries}}


\def\l@section#1#2{\addpenalty{\@secpenalty} \addvspace{1.0em plus 1pt}
 \@tempdima 1.5em \begingroup
 \parindent \z@ \rightskip \@pnumwidth 
 \parfillskip -\@pnumwidth 
 \bfseries \leavevmode #1\hfil \hbox to\@pnumwidth{\hss #2}\par
 \endgroup}
\def\l@subsection{\@dottedtocline{2}{1.5em}{2.3em}}
\def\l@subsubsection{\@dottedtocline{3}{3.8em}{3.2em}}
\def\l@paragraph{\@dottedtocline{4}{7.0em}{4.1em}}
\def\l@subparagraph{\@dottedtocline{5}{10em}{5em}}
\@ifundefined{c@section}{\newcounter{section}}{}
\@ifundefined{c@chapter}{\newcounter{chapter}}{}
\newif\if@mainmatter 
\@mainmattertrue
\def\chaptername{Chapter}
\def\frontmatter{%
  \pagenumbering{roman}
  \def\thechapter{\@roman\c@chapter}
  \def\theHchapter{\roman{chapter}}
  \def\thesection{\@roman\c@section}
  \def\theHsection{\roman{section}}
  \def\@chapapp{}%
}
\def\mainmatter{%
  \cleardoublepage
  \def\thechapter{\@arabic\c@chapter}
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \pagenumbering{arabic}
  \setcounter{secnumdepth}{6}
  \def\@chapapp{\chaptername}%
  \def\theHchapter{\arabic{chapter}}
  \def\thesection{\@arabic\c@section}
  \def\theHsection{\arabic{section}}
}
\def\backmatter{%
  \cleardoublepage
  \setcounter{chapter}{0}
  \setcounter{section}{0}
  \setcounter{secnumdepth}{2}
  \def\@chapapp{\appendixname}%
  \def\thechapter{\@Alph\c@chapter}
  \def\theHchapter{\Alph{chapter}}
  \appendix
}
\newenvironment{bibitemlist}[1]{%
   \list{\@biblabel{\@arabic\c@enumiv}}%
       {\settowidth\labelwidth{\@biblabel{#1}}%
        \leftmargin\labelwidth
        \advance\leftmargin\labelsep
        \@openbib@code
        \usecounter{enumiv}%
        \let\p@enumiv\@empty
        \renewcommand\theenumiv{\@arabic\c@enumiv}%
	}%
  \sloppy
  \clubpenalty4000
  \@clubpenalty \clubpenalty
  \widowpenalty4000%
  \sfcode`\.\@m}%
  {\def\@noitemerr
    {\@latex@warning{Empty `bibitemlist' environment}}%
    \endlist}

\def\tableofcontents{\section*{\contentsname}\@starttoc{toc}}
\parskip0pt
\parindent1em
\def\Panel#1#2#3#4{\multicolumn{#3}{){\columncolor{#2}}#4}{#1}}
\newenvironment{reflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemsep}{0pt}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\itshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{sansreflist}{%
  \begin{raggedright}\begin{list}{}
  {%
   \setlength{\topsep}{0pt}%
   \setlength{\rightmargin}{0.25in}%
   \setlength{\itemindent}{0pt}%
   \setlength{\parskip}{0pt}%
   \setlength{\itemsep}{0pt}%
   \setlength{\parsep}{2pt}%
   \def\makelabel##1{\upshape ##1}}%
  }
  {\end{list}\end{raggedright}}
\newenvironment{specHead}[2]%
 {\vspace{20pt}\hrule\vspace{10pt}%
  \phantomsection\label{#1}\markright{#2}%

  \pdfbookmark[2]{#2}{#1}%
  \hspace{-0.75in}{\bfseries\fontsize{16pt}{18pt}\selectfont#2}%
  }{}
      \def\TheFullDate{2014-01-15 (revised: 15 January 2014)}
\def\TheID{\makeatother }
\def\TheDate{2014-01-15}
\title{A Review of Security Mechanisms for Detection of Malicious Transactions in Database}
\author{}\makeatletter 
\makeatletter
\newcommand*{\cleartoleftpage}{%
  \clearpage
    \if@twoside
    \ifodd\c@page
      \hbox{}\newpage
      \if@twocolumn
        \hbox{}\newpage
      \fi
    \fi
  \fi
}
\makeatother
\makeatletter
\thispagestyle{empty}
\markright{\@title}\markboth{\@title}{\@author}
\renewcommand\small{\@setfontsize\small{9pt}{11pt}\abovedisplayskip 8.5\p@ plus3\p@ minus4\p@
\belowdisplayskip \abovedisplayskip
\abovedisplayshortskip \z@ plus2\p@
\belowdisplayshortskip 4\p@ plus2\p@ minus2\p@
\def\@listi{\leftmargin\leftmargini
               \topsep 2\p@ plus1\p@ minus1\p@
               \parsep 2\p@ plus\p@ minus\p@
               \itemsep 1pt}
}
\makeatother
\fvset{frame=single,numberblanklines=false,xleftmargin=5mm,xrightmargin=5mm}
\fancyhf{} 
\setlength{\headheight}{14pt}
\fancyhead[LE]{\bfseries\leftmark} 
\fancyhead[RO]{\bfseries\rightmark} 
\fancyfoot[RO]{}
\fancyfoot[CO]{\thepage}
\fancyfoot[LO]{\TheID}
\fancyfoot[LE]{}
\fancyfoot[CE]{\thepage}
\fancyfoot[RE]{\TheID}
\hypersetup{citebordercolor=0.75 0.75 0.75,linkbordercolor=0.75 0.75 0.75,urlbordercolor=0.75 0.75 0.75,bookmarksnumbered=true}
\fancypagestyle{plain}{\fancyhead{}\renewcommand{\headrulewidth}{0pt}}

\date{}
\usepackage{authblk}

\providecommand{\keywords}[1]
{
\footnotesize
  \textbf{\textit{Index terms---}} #1
}

\usepackage{graphicx,xcolor}
\definecolor{GJBlue}{HTML}{273B81}
\definecolor{GJLightBlue}{HTML}{0A9DD9}
\definecolor{GJMediumGrey}{HTML}{6D6E70}
\definecolor{GJLightGrey}{HTML}{929497} 

\renewenvironment{abstract}{%
   \setlength{\parindent}{0pt}\raggedright
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
   \textcolor{GJBlue}{\large\bfseries\abstractname\space}
}{%   
   \vskip8pt
   \textcolor{GJMediumGrey}{\rule{\textwidth}{2pt}}
   \vskip16pt
}

\usepackage[absolute,overlay]{textpos}

\makeatother 
      \usepackage{lineno}
      \linenumbers
      
\begin{document}

             \author[1]{Varada Bharat  Srinivas}

             \affil[1]{  KL University}

\renewcommand\Authands{ and }

\date{\small \em Received: 14 December 2013 Accepted: 2 January 2014 Published: 15 January 2014}

\maketitle


\begin{abstract}
        


Insider attacks formed the biggest threaten against database management systems. There are many mechanisms have been developed to detect and prevent the insider attacks called Detection of Malicious Activities in Database Systems DEMIDS. The DEMIDS consider as one of the last defenses mechanism of the database security system. There are many mechanisms that have been developed to detect and prevent the misuse activities like delete, and update data on the database systems. These mechanisms utilize auditing and profiling methods to detect and prevent the malicious activities. However these mechanisms still have problems to detect the misuse activities such as limit to detect the malicious data on authorized commands. This study will address these problems by propose a mechanism that utilizes dependency relationship among items to detect and prevent the malicious data by calculate a number of relations among data items. If the number of relations among items is not allowed any modification or deletion then the mechanism will detect activity as malicious activity. The evaluation parameters such as detect, false positive and false negative rate use to evaluate the accuracy of proposed mechanism.

\end{abstract}


\keywords{dependency relationship; detection; prevention; malicious; insider attack.}

\begin{textblock*}{18cm}(1cm,1cm) % {block width} (coords) 
\textcolor{GJBlue}{\LARGE Global Journals \LaTeX\ JournalKaleidoscope\texttrademark}
\end{textblock*}

\begin{textblock*}{18cm}(1.4cm,1.5cm) % {block width} (coords) 
\textcolor{GJBlue}{\footnotesize \\ Artificial Intelligence formulated this projection for compatibility purposes from the original article published at Global Journals. However, this technology is currently in beta. \emph{Therefore, kindly ignore odd layouts, missed formulae, text, tables, or figures.}}
\end{textblock*}


\let\tabcellsep& 	 	 		 
\section[{Introduction}]{Introduction}\par
nformation is one of the main assets of any organization which is essential to its continuity. Therefore, information security is very important to protect the confidentiality, integrity and availability of the information. Many systems and tools are used to achieve the requirements of the information security and to prevent information systems from any possible incident.\par
Access control systems, authentication systems, anti-virus software and firewalls are examples of such systems. According to \hyperref[b0]{[1]} despite different protection mechanism, it is nearly impossible to have a completely secured system. Although sophisticated security systems can be used to achieve the information security requirements, those systems may be under threat due to vulnerabilities or misconfiguration of those systems.\par
As a result, those vulnerabilities or misconfiguration may be exploited by intruders or implement their at-tacks. Therefore, Detection of Misuse Activities in Database Systems is considered as the last defense layer of the database security systems of any organization. The insider attack forms the biggest threaten on the database systems due to it has authorized access to the database systems. 
\section[{II.}]{II.} 
\section[{Background}]{Background}\par
There are many types of insider attack that try to abuse the access rights and do malicious activities for example, employees, masquerading and the malicious activities such as updated and deleted approved records. A malicious activity is de-fined as a group of actions that attempts to harm the Integrity, confidentiality of database system, \hyperref[b2]{[3]}. DEMIDS is a mechanism designed to detect and prevent the malicious activities such as malicious transactions on the database systems \hyperref[b3]{[4]}.\par
There are many insider attacks that may hurt the confidentiality, integrity and availability of database systems. According to \hyperref[b4]{[5]}the database security attacks classified into two types of attack such as: outsider attacks and insider attacks. The outsider attack can defined as malicious actions that cause many problems such as delay or bugs. However, the insider attacks categorized into legitimate and illegitimate access. Legitimate access can abuse his privilege to do malicious actions, and on the other hand, the illegitimate accesses try to exploit the vulnerabilities of the system to do malicious actions. Many researchers have been conducted to investigate the insider attacks \hyperref[b5]{[6]}. According to \hyperref[b1]{[2]}the insider attacker's forms the biggest threat on the database security level than the outsider attacker, because two reasons, the ir knowledge about systems and their granted privileges. \hyperref[b6]{[7]}Indicates that the insider attacks can forms the extremely dangerous on database systems. Furthermore, insider attacks use their rights to achieve the malicious action.\par
Malicious transaction is one of the inside attacks which harm the integrity and availability of the database \hyperref[b4]{[5]}. There are many causes of malicious activities \hyperref[b4]{[5]} such as bad configuration, low experiences of the Database administrator (DBA), hidden flaw and weakness of database implementation. \hyperref[b7]{[8]}Stated that the mechanisms based on auditing log file only detect the malicious commands, and if legitimate commands contain malicious data, it will not be detected. \hyperref[b7]{[8]}Proposed mechanism to detect the malicious activities in database sys-tem management.\par
The mechanism used data mining approach to determine the dependency among data items. The data dependency indicates to the access relations among  
\section[{E}]{E}\par
Chitanlapudi Sai Charan data items. These data dependency are generated in a set of rules (pre-written, read, and post-written sets). Therefore, the activities that don't follow any of rules are signed as malicious activity. The limitation of this mechanism is limited to user transactions that conform to the read-write patterns assumed by \hyperref[b7]{[8]}. Also, the system is notable to detect malicious behavior in individual read-write commands and the false alarm rate is may be more as well as the same sensitive are given to the each items and there is no concept of attribute sensitivity \hyperref[b5]{[6]}, \hyperref[b2]{[3]}. \hyperref[b8]{[9]}Addressed the problem of \hyperref[b7]{[8]}. The approach adds more rules to some attributes to become more sensitive to detect malicious modification. The limitation of this approach is identification of suitable support and confidence values, also is not suitable for the role based database access control, as well as it is not support other manipulation commands like insert and delete \hyperref[b10]{[11]}, \hyperref[b5]{[6]}.\par
[6]Try to address the problem of \hyperref[b7]{[8]}. This approach use to detect the malicious behavior based on RBAC (Role Based Access Control). The technique used in this approach working as control unit on the user role profile. If the technique discover that the user use different role than the normal role of user, then the mechanism will raise notification. The approach is suitable for databases that employ role based access control mechanism. The problem of \hyperref[b8]{[9]} also addressed in this approach. The limitation of this approach is inability to detect transaction level dependency; so some of the database attacks may be undetected \hyperref[b9]{[10]}.\par
[10] Addressed the problem of \hyperref[b5]{[6]} by extracts the correlation among queries of the transaction. The proposed mechanisms called DIDS (Database Intrusion Detection System) generate the transaction profiles mechanism automatically. This mechanism has two phases: learning phase and intrusion detection phase. The learning phase generates authorized transactions profile automatically. The detection phase will check the behavior of executable transactions by compare it with authorized transaction profile. The limitation of this approach that address by this study is difficult to capture the malicious data on authorized commands. Developed mechanism to detect the malicious transaction based on predefined profile transactions called Database Malicious Transaction Detection (DBMTD). Therefore, if the enter transaction is not matching with predefined transaction in the profile will detect as misuse or malicious transaction. The limitation of this approach is limited transactions and manual generating of the predefined profile transactions and this cause consuming time as well as difficult to achieve in real and complex database installations \hyperref[b12]{[13]}, \hyperref[b9]{[10]}.\par
The problem of the \hyperref[b11]{[12]} has been solved by \hyperref[b9]{[10]} which generate the transaction profiles mechanism automatically.\par
This approach used detection mechanism to detect the misuse activities. The limitation of this approach is inability to detect the authorized malicious activities like delete or update on approved records will address in this study by the author. The previous studies try to solve the problems of malicious activities on the relation database management system. However, the malicious data on the authorized commands can pass to the database. This study tries to address this kind of problems. 
\section[{a) Problem Statement}]{a) Problem Statement}\par
One of the database security problems is inside malicious activities. Among them are: updating of approved records with malicious data, and deleting approved records.\par
This study hypothesize that dependency relationship among items can be used to detect and prevent the aforementioned malicious activities. To test this hypothesis, the following questions needs to be answered:\par
i. How to represent the dependency relationship to detect and prevent malicious activities? ii. How to use the dependency relationship to detect and prevent the malicious activities?\par
III. 
\section[{Methodologies}]{Methodologies}\par
This chapter discusses the methodology used to design and develop the detection and prevention mechanism to detect the malicious activities that harm the integrity of database. Scientific research is the research which relies on the application of scientific method. So, scientific method can be defined as a set of research principles and methods that helps re-searchers obtain valid results from their research studies by providing a set of clear guidelines for gathering, evaluating, and reporting information in the context of research study  {\ref [20]}. 
\section[{a) Research Framework}]{a) Research Framework}\par
A methodology is required to guide the activities conducted by the project, in order to make sure that all project activities are well-organized. However, to gather all the in-formation related to the study, the researcher have to build a methodology or research framework to make sure that all the tasks of the project have been done clearly. Figure \hyperref[fig_1]{1} shows the project research framework. The first step in achieving this project was the initial planning phase. First of all, the title of the project was discussed with the supervisor. The objective of the project development reviewed and defined according to the problem statement. Besides that, the scope of the project identified to draw the boundary for this project. After that, some re-search on the problem background of the project was done in order to decide on the methodology of the project. 
\section[{Global Journal of Computer Science and Technology}]{Global Journal of Computer Science and Technology} 
\section[{Phase 2: Literature Review}]{Phase 2: Literature Review}\par
The literature review should give a theoretical base for the research and help to resolve the nature of the research. The purpose from writing the literature review is to reveal to the reader what knowledge and ideas have been established on a topic by previous studies and how similar are they to this project topic. Thus, the literature review for this study started with overview on information security in general term. Then the literature re-view focused on the components influencing on information security, such as insider attack, malicious trans-action. Moreover, continue the study by talking about importance of dependency relationship in the relational database systems. Finally, the discussion goes through related works on how to detect and prevent the misuses activities on the relational database systems. It has two parts: 
\section[{i. Dependency Relationship}]{i. Dependency Relationship}\par
This part focus about dependency relationship concept, including the purpose of dependency relationship and how the dependency relationship among items can use to detect and prevent the malicious activities. 
\section[{ii. Detection mechanisms}]{ii. Detection mechanisms}\par
Some of the mechanisms that used to detect and prevent the malicious activities have been mentioned in this part. Also the methods used in these mechanisms such as auditing log files, profiling, data mining, and dependency relationship. 
\section[{Phase 3: Design the proposed mechanism}]{Phase 3: Design the proposed mechanism}\par
In this phase, the design of the mechanism will be developed which will contain specification on the mechanism components. The components of the mechanism are three layers:\par
Input layer, detection and prevention layer and database layer as follow: 
\section[{i. Input Layer}]{i. Input Layer}\par
This layer will used to input data to the mechanism. The source of input data is a dataset that constructed by this study. The dataset contains more than 20,000 records that include malicious and none malicious records. 
\section[{ii. Detection Layer Based on Dependency Relationship}]{ii. Detection Layer Based on Dependency Relationship}\par
It considers the most important layer in the mechanism. It will receive the data from the input layer and check if there is malicious or not. It is collection of objects such dependency algorithm, alerter and events table. The components of this layer are: 
\section[{Dependency Algorithm}]{Dependency Algorithm}\par
The DA dependency algorithm is a set of instructions that used to calculate the total dependency relationship among date items and calculate the data items that related with, to mining the malicious data among items. Chapter 4 will ex-plain more about it. 
\section[{Alerter}]{Alerter}\par
During the process, the malicious activities like updating or deleting commands will be detected by the mechanism. Therefore, an alert needed to be raised by the alerter and notify the DBA. 
\section[{Events Table}]{Events Table}\par
This table used to store the misuse activities events when happened. 
\section[{Database Layer}]{Database Layer}\par
The database layer is the original database tables (schema), which store the clean data that coming from the detection and prevention layer. The database layer includes the definition and transaction tables.\par
1. Definition Tables: These tables store the primary and fix data of the system. 2. Transaction Table  {\ref :} The tables which have the transaction data those changes continuously, for example salaries tables, check tables and so on. Phase 4: Develop the Proposed Mechanism Three software products will used to develop the proposed mechanism: i. PL/SQL Language Procedural language/ structured query language is the best language to develop the logic of the mechanism. It has a good feature such as: flexibility, easy to use, control statement and so on. Pl/SQL will used to connect all components of the mechanism. 
\section[{ii. Oracle Database}]{ii. Oracle Database}\par
The oracle database will used to create target database schema such as: tables, views, triggers, procedures and functions of the mechanism.\par
iii. 
\section[{Oracle Developer2000}]{Oracle Developer2000}\par
Oracle developer is one of the oracle corporation products. The oracle developer2000 will be used to build the inter-faces of the mechanism (input layer). 
\section[{Evaluation of the Proposed Mechanism}]{Evaluation of the Proposed Mechanism}\par
This phase will evaluate the mechanism to verify it meet the project objectives or not. To evaluate the mechanism there are some steps should be executed such as execute the proposed mechanism, baseline, and evaluation measures and compare the result. 
\section[{i. Execute the Proposed Mechanism}]{i. Execute the Proposed Mechanism}\par
Execute the proposed mechanism to get the results and com-pare it with existing mechanism. The exiting mechanism is DIDS (Database Intrusion Detection system), \hyperref[b9]{[10]}.\par
ii. Baseline The baseline of this project is used DIDS (Database Intrusion Detection System), \hyperref[b9]{[10]}.The DIDS is one of the mechanisms that used to detect and prevent the malicious activities in database. 
\section[{iii. Evaluation Parameters}]{iii. Evaluation Parameters}\par
The measures that will be used in this study to evaluation the accuracy of the proposed mechanism are: detection rate, false negative and false positive rates measures. 
\section[{Detection Rate}]{Detection Rate}\par
Detection rate refers to the percentage of detected malicious events, namely detection rate is equal to the product of the quotient of dividing the number of detected intrusion events by the total of malicious events and 100\%. 
\section[{False positive Rate}]{False positive Rate}\par
Rate of false negative refers to the probability that correct events are falsely detected as abnormal events, namely rate of false positive is equal to the product of the quotient of dividing the number of events which are falsely detected as abnormal events by the total of events and 100\%. 
\section[{False Negative Rate}]{False Negative Rate}\par
Rate of the false negative represent the abnormal or harmful activities which are classified wrongly by detection mechanism as normal activities, namely Rate of false negative is equal to the product of the quotient of dividing the number of events which are falsely detected as normal events by the total of events and 100\%. 
\section[{Compare the Results}]{Compare the Results}\par
The results that have gotten will be compared with the results in the existing mechanism. These results will compare the ac-curacy of the proposed mechanism with accuracy in the existing mechanism.\par
IV. 
\section[{Conclusion a) Entail Design of the mechanism}]{Conclusion a) Entail Design of the mechanism}\par
The initial results that have gets from this study are initial design of the mechanism, and the flowchart of the mechanism working. Figure \hyperref[fig_3]{2}: show the architectture design for the mechanism and the relations among the components of mechanism. Figure  {\ref 3shows} the mechanism flow processes of the mechanism. According to the proposed dependency algorithm among items the calculate relations among items and data items that related with these relations will be accrue. For example, if the total number of relationship among items is greater than or equal three relations then the attribute is more used and high important. After, that checks the data in the items. On the other hand,if the total relations among items equal 2 (low important), and the two data items have been used already. So, if there is up-dated or deleted command on only one data item without other item, it will determine as malicious command. However, if there is updating or deleting in parallel on these two data items, it will be determine as malicious but it will be pass and committed in database.  
\section[{Global}]{Global}\begin{figure}[htbp]
\noindent\textbf{1}\includegraphics[]{image-2.png}
\caption{\label{fig_1}VolumeFigure 1 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{2}\includegraphics[]{image-3.png}
\caption{\label{fig_3}Figure 2 :}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-4.png}
\caption{\label{fig_5}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-5.png}
\caption{\label{figure5}}\end{figure}
 \begin{figure}[htbp]
\noindent\textbf{}\includegraphics[]{image-6.png}
\caption{\label{figure6}}\end{figure}
 			\footnote{© 2014 Global Journals Inc. (US)} 			\footnote{© 2014 Global Journals Inc. (US) 2 Year 2014} 			\footnote{© 2014 Global Journals Inc. (US) 4 Year 2014} 		 		\backmatter  			 \par
data has been written already in more than one item, then this item is used in other places by other users and the update or delete is prohibited and classified as malicious. 
\subsection[{Figure 3 : Mechanism Flow processes}]{Figure 3 : Mechanism Flow processes}\par
The proposed dependency algorithm working as:\par
When the authorized user send a command to the database, the algorithm checks the command type, if insert then will move directly to database. However, if the command update or delete then, the algorithm will check first the total number of the dependency relationship among items(TR) and then check the total number of data items(TD) that related by the relation dependency. Therefore, if the TR greater than or equal three relations, then check the relevant data items if data has been written already to more than one item , then the mechanism will detect the activity as malicious and prevent it and notify the DBA as well as write the events to the events table. On the other hand, if the TR equal two relations then check the TD if written in more than one item, then check the activity on two data items, if parallel activity then detect as malicious but can pass to the database, owing to the data may be correct or not, but if the activity is only on the one data item, then detect as malicious activity and prevent it, and also notify the DBA and write the event in events table. Algorithm in figure  {\ref 4} will explain the proposed dependency algorithm among items. 			 			  				\begin{bibitemlist}{1}
\bibitem[Hui and Zulke Rnine ()]{b0}\label{b0} 	 		‘A software implementation of a genetic algorithm based approach to net-work intrusion detection. Software Engineering, Artificial intelligence’.  		 			Ren Hui 		,  		 			G 		,  		 			M Zulke Rnine 		.  	 	 		\textit{Networking unparallel/Distributed Computing, 2005 and First ACIS international Workshop on Self-Assembling Wireless Networks. SNPD/SAWN 2005. Sixth international Conference on},  				2005.  	 
\bibitem[Chung et al. ()]{b3}\label{b3} 	 		‘Demids: A misuse detection system for database systems’.  		 			C Y Chung 		,  		 			M Gertz 		,  		 			K Levitt 		.  	 	 		\textit{14th IFIP WG11.3 Working Conference on Database and Application Security},  				2000.  	 
\bibitem[Rao (2011)]{b9}\label{b9} 	 		‘Design and Implementation of Database Intrusion Detection system for Security in Database’.  		 			U Rao 		,  		 			DR P 		.  	 	 		\textit{International Journal of Computer Applications}  		2011. December 2011. 35  (9)  p. .  	 
\bibitem[Patel (2011)]{b10}\label{b10} 	 		‘Design and Implementation of Database Intrusion detection system for Security in Database’.  		 			U P R D R Patel 		.  	 	 		\textit{Proceedings of the 2008 ACM symposium on applied computing},  				 (the 2008 ACM symposium on applied computingFortaleza, Ceara, Brazil, ACM)  		2011. December 2011. 35 p. .  	 
\bibitem[Shatnawi and Mardini (2011)]{b1}\label{b1} 	 		‘Detection of Insiders Misuse’.  		 			Nahla Shatnawi 		,  		 			QA 		,  		 			Wail Mardini 		.  	 	 		\textit{database Systems proceedings of the international Multi Conference of Engineers and computer Science},  				 (Hong Kong)  		2011. 2011. 2011. March 16 -18, 2011.  	 
\bibitem[Yushi and Bansal (2010)]{b4}\label{b4} 	 		‘Detection of Malicious Transactions in DBMS’.  		 			A S Yushi 		,  		 			Reena Bansal 		.  	 	 		\textit{international Journal of Information Technology and Knowledge Management}  		2010. July-december 2010. 2  (2)  p. .  	 
\bibitem[Vieira and Madeira ()]{b11}\label{b11} 	 		‘Detection of malicious transactions in DBMS. Dependable computing’.  		 			M Vieira 		,  		 			H Madeira 		.  	 	 		\textit{Proceedings. 11th Pacific Rim International Symposium on},  				 (11th Pacific Rim International Symposium on)  		2005. 2005.  	 
\bibitem[Yi and Panda ()]{b7}\label{b7} 	 		‘Identification of malicious trans-actions in database systems. Database Engineering and Applications Symposium’.  		 			H Yi 		,  		 			B Panda 		.  	 	 		\textit{Proceedings. Seventh international},  				 (Seventh international)  		2003. 2003.  	 
\bibitem[Bertino and Terzi ()]{b5}\label{b5} 	 		‘Intrusion detection in RBAC administered databases’.  		 			E Bertino 		,  		 			E Terzi 		.  	 	 		\textit{Computer Security Applications Conference},  				2005.  	 	 (21st Annual) 
\bibitem[Jos ()]{b12}\label{b12} 	 		‘Online detection of malicious data access using DBMS auditing’.  		 			Jos 		.  	 	 		\textit{Lab}  		2008.  	 
\bibitem[Asmawi and Sidek ()]{b6}\label{b6} 	 		\textit{System architecture for SQL injection and insider misuse detection system for DBMS. Information Technology},  		 			A Asmawi 		,  		 			Z M Sidek 		.  		2008. 2008. 2008.  	 	 (IT Sim. International Symposium on) 
\bibitem[Heady ()]{b2}\label{b2} 	 		\textit{The architecture of a network level intrusion Javidi},  		 			R Heady 		.  		1990.  	 
\bibitem[Srivastava and Sural ()]{b8}\label{b8} 	 		‘Weighted intratransactional rule mining for database intrusion detection’.  		 			A Srivastava 		,  		 			S Sural 		.  	 	 		\textit{Proceedings of the 10th Pacific-Asia conference on Advances in knowledge Discovery and Data Mining},  				 (the 10th Pacific-Asia conference on Advances in knowledge Discovery and Data MiningSingapore)  		2006. Springer-Verlag. p. .  		 			Dept of Computer Science 		 	 
\end{bibitemlist}
 			 		 	 
\end{document}
