This paper presents a real-time database forensic framework designed to detect insider threats within database management systems (DBMSs). Existing database forensic approaches, as identified through a systematic literature review employing the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) methodology, are predominantly reactive and post-mortem in nature, lacking real-time SQL-layer visibility, forensic correlation, and evidence integrity assurance. To address these gaps, the proposed framework integrates native Microsoft SQL Server auditing mechanisms with a centralized ELK (Elasticsearch-Logstash-Kibana) pipeline to enable continuous evidence collection, automated correlation, and real-time visualization. The framework is evaluated against six insider-threat scenarios within the SPL ForensicDB—a simulated enterprise logistics database environment modeled after Saudi Post Logistics (SPL)—encompassing unauthorized access, data exfiltration, privilege escalation, data manipulation, backdoor creation, and audit suppression. Experimental results demonstrate high detection accuracy (precision: 0.92, recall: 0.88), a low false-positive rate of 3%, and alert latency consistently below five seconds, with minimal system overhead of 3.2% CPU utilization. The framework further ensures forensic integrity through SHA-256-verified, tamper-resistant audit logs and a structured chain-of-custody preservation mechanism compliant with ISO/IEC 27037:2012, making it suitable for both proactive security monitoring and legally defensible digital forensic investigations.
AlQahtani et al. (Thu,) studied this question.