Detecting abnormal database activity

A system for detecting abnormal activity on a processing device comprising:

• at least one processor configured to:
• receive time series data including information pertaining to a corresponding attribute of monitored activity on the processing device;
• determine an upper bound of the time series data based on a weighted combination of a prior upper bound and a current value derived from the time series data, wherein greater weight is provided to greater values in the time series data based on an exponent applied to the prior upper bound and the current value and an effect of older values in the time series data decays over time based on a smoothing factor applied to exponential values of the prior upper bound and the current value that are derived from applying the exponent;
• apply the upper bound to a profile of an entity associated with the monitored activity, wherein the profile includes bounds for attributes of activities of the entity indicating valid behavior and the upper bound is compared to a corresponding bound of the profile;
• and
• detect abnormal activity on the processing device based on the comparison of the upper bound to the corresponding bound of the profile.

A computer program product for detecting abnormal activity on a processing device, the computer program product comprising one or more computer readable storage media having program instructions collectively stored on the one or more computer readable storage media, the program instructions executable by a processor to cause the processor to:

• receive time series data including information pertaining to a corresponding attribute of monitored activity on the processing device;
• determine an upper bound of the time series data based on a weighted combination of a prior upper bound and a current value derived from the time series data, wherein greater weight is provided to greater values in the time series data based on an exponent applied to the prior upper bound and the current value and an effect of older values in the time series data decays over time based on a smoothing factor applied to exponential values of the prior upper bound and the current value that are derived from applying the exponent;
• apply the upper bound to a profile of an entity associated with the monitored activity, wherein the profile includes bounds for attributes of activities of the entity indicating valid behavior and the upper bound is compared to a corresponding bound of the profile;
• and
• detect abnormal activity on the processing device based on the comparison of the upper bound to the corresponding bound of the profile.