Autonomous machine learning methods for detecting and thwarting malicious database access

A non-transitory, processor-readable medium storing instructions to cause a processor to:

• receive a request including a representation of a query and referencing an encrypted database;
• identify at least one request attribute from a plurality of request attributes associated with the request, the plurality of request attributes including a representation of at least one of:
• a user identifier, a source application, a timestamp, an internet protocol (IP) address, a geographic location, a target object, a query type, an amount of data being requested, a command type, or a number of queries including the database query and within a predefined time period;
• during a first time period, process the request to identify a query result;
• during the first time period, analyze the at least one request attribute using a self-learning machine learning algorithm, to identify an aggregate anomaly score for anomaly detection based on a plurality of different predefined thresholds;
• in response to the aggregated anomaly score exceeding a first threshold from the plurality of predefined thresholds, cause a signal representing a quarantine request to be sent, and not causing a signal representing the query result to be sent;
• in response to the aggregated anomaly score being between the first threshold and a second threshold from the plurality of predefined thresholds, cause a signal representing a notification to be sent, and cause a signal representing the query result to be sent;
• and
• in response to the aggregated anomaly score being below the second threshold, cause a signal representing a notification that the request is allowed to be sent, without sending a signal representing content from the database referenced by the query.