Distribution-Based Analysis Of Queries For Anomaly Detection With Adaptive Thresholding
AssigneeOracle International Corporation
InventorsRahul V. Herwadkar, Joydip Kundu, Anindya Chandra Patthak
Life of this patent
Estimating the term…
Abstract
Techniques for detecting an anomaly in queries of a relational database are disclosed. The techniques include identifying a set of attribute values from a query for accessing data within a database. Based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values is determined. When at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, an indication that the query is anomalous is outputted.
Claims20
A non-transitory computer readable medium comprising instructions which, when executed by one or more hardware processors, causes performance of operations comprising:
- identifying a set of attribute values from a query for accessing data within a database;
- determining, based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values;
- and
- when at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, outputting an indication that the query is anomalous.
A method comprising:
- identifying a set of attribute values from a query for accessing data within a database;
- determining, based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values;
- and
- when at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, outputting an indication that the query is anomalous.
A system comprising:
- one or more hardware processors;
- one or more non-transitory computer readable media storing instructions which, when executed by the one or more hardware processors, causes performance of operations comprising:
- identifying a set of attribute values from a query for accessing data within a database;
- determining, based on previously received queries, at least one of a joint probability for the set of attribute values or individual probabilities for the set of attribute values;
- and
- when at least one of the joint probability for the set of attribute values or an individual probability for one or more attribute values in the set of attribute values does not satisfy a probability cutoff, outputting an indication that the query is anomalous.
Dependencies are inferred from the claim text.