Abstract:Abnormal data access operations in database systems always hap-pen, which are typically incurred by misoperations or attacks, though these systems are enforced with strict access control policies. However, prior arts only focus on detecting abnormal data accesses by utilizing known attack patterns or identifying behaviors significantly deviated from normal behaviors. They cannot capture stealthy abnormal data access operations that are similar to normal ones. In this paper, we propose a novel unsupervised anomaly detection system UCAD, which aims to detect abnormal data access operations, by comparing operation's semantics with their contextual intent. However, it is non-trivial to obtain accurate semantics of operations for intent analysis because (i) the same operation may exhibit diverse semantics under different operation contexts and (ii) different operation sequences could have identical semantics due to heterogeneous user access patterns. To address this issue, we develop a new transformer model called Trans-DAS for UCAD. Trans-DAS learns the semantics of individual operations by utilizing the attention mechanism that analyzes the relevance between any pair of operations in sequence, and captures the contextual intent of operations inferred from the contexts. Specifically, Trans-DAS utilizes a particular embedding layer to embed the semantics of individual operations without the operation order information and a masking mechanism that allows Trans-DAS to learn the semantics according to the bidirectional contexts. Also, we define a new training objective for Trans-DAS to enlarge the difference among the embedded semantics. Furthermore, in order to effectively utilize Trans-DAS for detection, we develop two modules in UCAD, i.e., a data preprocessing module that allows Trans-DAS to accurately learn the normal semantic information by removing noisy data, and an anomaly detection module that learns the semantic information for intent comparison. We evaluate the performance of UCAD on real-world data traces under different settings (e.g., varied parameters and hybrid datasets). The results demonstrate that UCAD achieves the average F1-score of 0.94 in two scenarios, which significantly outperform baselines, and shows robustness to hybrid data and good transferability to different tasks.

UAC-AD: Unsupervised Adversarial Contrastive Learning for Anomaly Detection on Multi-modal Data in Microservice Systems

Learning Discrimination from Contaminated Data: Multi-Instance Learning for Unsupervised Anomaly Detection

Hierarchical Semi-supervised Contrastive Learning for Contamination-Resistant Anomaly Detection

Unilaterally Aggregated Contrastive Learning with Hierarchical Augmentation for Anomaly Detection

A Diffusion-Based Framework for Multi-Class Anomaly Detection

DACAD: Domain Adaptation Contrastive Learning for Anomaly Detection in Multivariate Time Series

A Unified Model for Multi-class Anomaly Detection

TimeAutoAD: Autonomous Anomaly Detection With Self-Supervised Contrastive Loss for Multivariate Time Series

ToCoAD: Two-Stage Contrastive Learning for Industrial Anomaly Detection

An adversarial contrastive autoencoder for robust multivariate time series anomaly detection

Unsupervised Continual Anomaly Detection with Contrastively-learned Prompt

CL-MMAD: A Contrastive Learning Based Multimodal Software Runtime Anomaly Detection Method

A Novel Contrastive Learning Framework for Self-Supervised Anomaly Detection

HCL-MTSAD: Hierarchical Contrastive Consistency Learning for Accurate Detection of Industrial Multivariate Time Series Anomalies

Unsupervised Contextual Anomaly Detection for Database Systems

Constrained Contrastive Distribution Learning for Unsupervised Anomaly Detection and Localisation in Medical Images

Robust Anomaly Detection from Partially Observed Anomalies with Augmented Classes

Explicit Boundary Guided Semi-Push-Pull Contrastive Learning for Supervised Anomaly Detection

LUAD: A lightweight unsupervised anomaly detection scheme for multivariate time series data

SCAAE: Using Self-Supervised Contrastive Learning in Adversarial AutoEncoder for Anomaly Detection of Multivariate Time Series in Cyber Physics Systems

Abnormal Event Detection Using Deep Contrastive Learning for Intelligent Video Surveillance System