Oracle Corporation
Distribution-based analysis of queries for anomaly detection with adaptive thresholding

Abstract:

Techniques for detecting an anomaly in queries of a relational database are disclosed. The techniques include identifying a set of attribute values from a query for accessing data within a database. Based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values is determined. When at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, an indication that the query is anomalous is outputted.