Abstract:Abnormal data access operations in database systems always hap-pen, which are typically incurred by misoperations or attacks, though these systems are enforced with strict access control policies. However, prior arts only focus on detecting abnormal data accesses by utilizing known attack patterns or identifying behaviors significantly deviated from normal behaviors. They cannot capture stealthy abnormal data access operations that are similar to normal ones. In this paper, we propose a novel unsupervised anomaly detection system UCAD, which aims to detect abnormal data access operations, by comparing operation's semantics with their contextual intent. However, it is non-trivial to obtain accurate semantics of operations for intent analysis because (i) the same operation may exhibit diverse semantics under different operation contexts and (ii) different operation sequences could have identical semantics due to heterogeneous user access patterns. To address this issue, we develop a new transformer model called Trans-DAS for UCAD. Trans-DAS learns the semantics of individual operations by utilizing the attention mechanism that analyzes the relevance between any pair of operations in sequence, and captures the contextual intent of operations inferred from the contexts. Specifically, Trans-DAS utilizes a particular embedding layer to embed the semantics of individual operations without the operation order information and a masking mechanism that allows Trans-DAS to learn the semantics according to the bidirectional contexts. Also, we define a new training objective for Trans-DAS to enlarge the difference among the embedded semantics. Furthermore, in order to effectively utilize Trans-DAS for detection, we develop two modules in UCAD, i.e., a data preprocessing module that allows Trans-DAS to accurately learn the normal semantic information by removing noisy data, and an anomaly detection module that learns the semantic information for intent comparison. We evaluate the performance of UCAD on real-world data traces under different settings (e.g., varied parameters and hybrid datasets). The results demonstrate that UCAD achieves the average F1-score of 0.94 in two scenarios, which significantly outperform baselines, and shows robustness to hybrid data and good transferability to different tasks.

Unsupervised Conditional Adversarial Networks for Tax Evasion Detection.

Unsupervised Domain Adaptation with Adversarial Learning for Liver Tumors Detection in Multi-phase CT Images

Trust-aware Conditional Adversarial Domain Adaptation with Feature Norm Alignment.

Auto-AD: Autonomous Hyperspectral Anomaly Detection Network Based on Fully Convolutional Autoencoder

An Accurate Unsupervised Liver Lesion Detection Method Using Pseudo-lesions

Unsupervised Domain Adaptation for Crime Risk Prediction Across Cities

Detecting Transaction-based Tax Evasion Activities on Social Media Platforms Using Multi-modal Deep Neural Networks

Uncertainty-Aware Unsupervised Domain Adaptation in Object Detection

Electronic Nose Drift Suppression Based on Smooth Conditional Domain Adversarial Networks

CTCN: a novel credit card fraud detection method based on Conditional Tabular Generative Adversarial Networks and Temporal Convolutional Network

Credit Card Fraud Detection Based on Unsupervised Attentional Anomaly Detection Network

An Efficient Deep Unsupervised Domain Adaptation for Unknown Malware Detection

Tax evasion risk management using a Hybrid Unsupervised Outlier Detection method

Importance Weighted Adversarial Discriminative Transfer for Anomaly Detection

A Novel Spatiotemporal Prediction Approach Based on Graph Convolution Neural Networks and Long Short-Term Memory for Money Laundering Fraud

Deep Learning for Cross-Border Transaction Anomaly Detection in Anti-Money Laundering Systems

Unified unsupervised and semi-supervised domain adaptation network for cross-scenario face anti-spoofing

UAC-AD: Unsupervised Adversarial Contrastive Learning for Anomaly Detection on Multi-modal Data in Microservice Systems

Unsupervised Contextual Anomaly Detection for Database Systems

Weakly Supervised Facial Action Unit Recognition Through Adversarial Training.

Autoencoder-based Unsupervised Intrusion Detection using Multi-Scale Convolutional Recurrent Networks