Anomaly score normalisation based on extreme value theory

A method comprising:

• receiving a plurality of unnormalized anomaly scores;
• selecting a highest subset of the plurality of unnormalized anomaly scores that exceed a tail threshold;
• training, based on the highest subset of the plurality of unnormalized anomaly scores, parameters of a probability density function;
• first detecting, after said training, whether that a first unnormalized anomaly score for a first database statement does not exceed the tail threshold;
• second detecting, in response to said first detecting, that the first database statement is not anomalous;
• third detecting, after said training, that a second unnormalized anomaly score for a second database statement exceeds the tail threshold;
• generating, in response to said third detecting, a normalized anomaly score based on:
• the second unnormalized anomaly score and the parameters of the probability density function;
• and
• fourth detecting that the second database statement is anomalous, including detecting that the normalized anomaly score exceeds the tail threshold;
• wherein the method is performed by one or more computers.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause:

• receiving a plurality of unnormalized anomaly scores;
• performing for each predefined tail threshold in a plurality of predefined tail thresholds:
• a) selecting a highest subset of the plurality of unnormalized anomaly scores that exceed the predefined tail threshold;
• b) training, based on the highest subset of the plurality of unnormalized anomaly scores, parameters of a probability density function;
• and
• c) measuring a fitness score of the parameters of the probability density function for the highest subset of the plurality of unnormalized anomaly scores;
• generating an unnormalized anomaly score based on a feature vector that contains i) at least a portion of a database statement and ii) at least one selected from the group consisting of:
• an identifier of a database session, a network address of a database client, and an identifier of an operating system (OS) of a database client;
• generating, by the probability density function for the predefined tail threshold with a highest fitness score, a normalized anomaly score from the unnormalized anomaly score;
• and
• detecting, based on the normalized anomaly score, that the database statement is anomalous.

One or more non-transitory computer-readable media storing instructions that, when executed by one or more processors, cause:

• receiving a plurality of unnormalized anomaly scores;
• selecting a highest subset of the plurality of unnormalized anomaly scores that exceed a tail threshold;
• training, based on the highest subset of the plurality of unnormalized anomaly scores, parameters of a probability density function;
• first detecting, after said training, whether that a first unnormalized anomaly score for a first database statement does not exceed the tail threshold;
• second detecting, in response to said first detecting, that the first database statement is not anomalous;
• third detecting, after said training, that a second unnormalized anomaly score for a second database statement exceeds the tail threshold;
• generating, in response to said third detecting, a normalized anomaly score based on:
• the second unnormalized anomaly score and the parameters of the probability density function;
• and
• fourth detecting that the second database statement is anomalous, including detecting that the normalized anomaly score exceeds the tail threshold.