Anomaly Detection of User Behavior for Database Security Audit Based on OCSVM

In view of the defects of safety monitoring and comprehensive audit in information network boundaries of State Grid Corporation of China(SGCC), a kind of security audit technology based on one-class support vector machine(OCSVM) is proposed for the security audit of user access behavior. Firstly, feature selection, syntax parsing of SQL statements and numerical processing of audit log are completed to obtain the feature vector of user behavior, which can be trained and identified by OCSVM. Then the audit logs that reflect the rules of normal behavior in the long-term operation of the database are used as the OCSVM's training input, after the training to obtain the OCSVM classifier, so as to construct the detection pattern library of user behavior. Finally, we use the OCSVM classifier to detect the abnormal behavior of database operations, and realize the security audit of database user access behavior.