Anomalous Query Identification Using Query Clustering

A non-transitory computer-readable medium having instructions stored thereon that are capable of causing a computing device to implement operation comprising:

• receiving a new query from a computer system;
• retrieving, prior to execution of the new query, an estimated execution plan from a query optimizer, the estimated execution plan specifying a plurality of estimated metrics;
• generating a multi-dimensional query vector for the new query based on a set of query aspects, wherein the set of query aspects includes at least the plurality of estimated metrics retrieved from the query optimizer;
• determining a shortest distance within a multi-dimensional aspect space between the multi-dimensional query vector and a closest centroid of a plurality of clusters representing previously received queries;
• comparing the shortest distance with a multi-level distance threshold, wherein the multi-level distance threshold includes a first distance requirement and a second distance requirement;
• and
• escalating a restrictive preventative action for the new query based on the comparing, wherein the escalating includes:
• requesting one or more authentication factors from the computer system when the shortest distance is between the first distance requirement and the second distance requirement.

A system, comprising:

• at least one processor;
• and
• a memory having instructions stored thereon that are executable by the at least one processor to cause the system to perform workload management operations, comprising:
• receiving a new query from a computing device;
• retrieving, prior to execution of the new query, an estimated execution plan from a query optimizer, the estimated execution plan specifying a plurality of estimated metrics;
• generating a multi-dimensional query vector for the new query based on a set of query aspects, wherein the set of query aspects includes at least the plurality of estimated metrics retrieved from the query optimizer;
• determining a shortest distance within a multi-dimensional aspect space between the multi-dimensional query vector and a closest centroid of a plurality of clusters representing previously received queries;
• comparing the shortest distance with a multi-level distance threshold, wherein the multi-level distance threshold includes a first distance requirement and a second distance requirement;
• and
• escalating a restrictive preventative action for the new query based on the comparing, wherein the escalating includes:
• automatically rejecting the new query when the shortest distance is greater than the second distance requirement.