Whodunit: an auditing tool for detecting data breaches

AbstractCommercial database systems provide support to maintain an audit trail that can be analyzed offline to identify potential threats to data security. We present a tool that performs data auditing that asks for an audit trail of all users and queries that referenced sensitive data, for example "find all queries and corresponding users that referenced John Doe's salary in the last six months". Our tool: (1) handles complex SQL queries including constructs such as grouping, aggregation and subqueries, (2) has privacy guarantees, and (3) incorporates novel optimization techniques for efficiently auditing a large workload of complex SQL queries.