User Behavior Profile: A key to Database Anomaly Access Detection

As the database contains various important information, malicious persons often attack it. To deal with an attack from outside, the database administrator often restricts the access of unauthorized users through the role-based access control system. Overview, the study about anomaly detection of database user behavior existed essential using value. In our work, K-means algorithm, PCA algorithm and random tree are used to deal with user profiles, and database user behavior anomaly detection approach is formally introduced. According to query sequences, the user profiles are constructed based on TPC-C and TPC-E standards, respectively. Specifically, we use the K-means cluster method to divide TPC-C dataset's users into different groups, clustering users with similar query behaviors into the same group. We use the PCA algorithm to diminish dimension of the high-dimensional user profile vector for the dataset of TPC-E. In this way, the training time of the detector can be reduced. Then we train anomaly detector by using the random tree algorithm for two datasets. Our method is faster and more effective in detecting database anomalies than other work by the experimental result.