Tracking and Repairing Damaged Databases Using Before Image Table

Traditional damage assessment approaches can only locate damage caused by reading corrupted data in a post-intrusion database. This paper indicates another kind of damage spreading pattern characterized by omitting maliciously deleted data, which was not considered in previous studies. An extended recovery model arms at this problem is presented and a novel approach based on the model is proposed to recover a damaged database from malicious attacks. This approach can track the damage spreading more completely by maintaining before image tables (BI tables) in databases and analyzing transactions' potential-read to the BI tables. BI tables are also used for damage repair without accessing database logs. Experimental evaluation of the overhead of this method based upon TPC-C benchmark is also presented.