Specification-Based Intrusion Detection for Role-Based Database Management System

Detecting intrusions in database systems is challenging due to the use of legitimate credentials and the scarcity of labeled attack data. This paper presents a specification-based intrusion detection system (IDS) for role-based access control (RBAC) database environments that automatically derives behavioral policies from normal transaction traces and enforces them at runtime. The proposed framework employs a specification check followed by a novel-bigram gate, i.e., a deterministic specification layer that checks role-specific read and write permissions and read-before-write dependencies. An optional novel-bigram gate then flags adjacent operation pairs that never occur in normal training for that role. Isolation Forest was evaluated as a further residual scorer and is not part of the recommended detector. On a synthetic RBAC holdout, the specification layer alone achieves 98.4% accuracy, 100% precision, and 86.0% recall, with zero false positives. The novel-bigram gate raises accuracy to 98.8% and recall to 89.6% while keeping precision at 100%. Isolation Forest detects no further attack and adds eight false positives. These results show that the learned rules and the bigram gate carry the detection and that the tested one-class model does not justify its cost on this corpus. Each detection is accompanied by a human-readable reason, which is useful for audit. The study does not claim efficacy against adaptive adversaries or production DBMS workloads.