UDAD: An Accurate Unsupervised Database Anomaly Detection Method

Database systems are widely employed to store crucial data across domains. However, an increasing emergence of stealthy abnormal database access behaviors, such as re-identification and differential attacks, has been observed. These behaviors exhibit short durations and similarities to normal actions, challenging existing detection methods. Moreover, current approaches lack granularity in pinpointing anomalies at the operational level. They treat entire sequences of operations as anomalies, though the majority likely represent normal behavior, with only a few as anomalies. This paper presents UDAD, a novel method for precisely detecting stealthy abnormal database access behaviors. By transforming SQL statements into semantic vectors, we enhance the learning of embedded semantic information. Through the integration of an attention-based BiLSTM model and an autoencoder, UDAD achieves accurate detection and precise localization of abnormal operations. We evaluate UDAD on publicly available datasets, demonstrating its superiority over state-of-the-art methods.