Abnormal score normalization based on extremum theory

Abstract

The invention relates to threshold estimation and calibration for anomaly detection. This document is machine learning (ML) and extreme value theory (EVT) techniques for normalizing and thresholding anomaly scores without assuming value distributions. In an embodiment, a computer receives a number of non-normalized anomaly scores and selects a highest subset of the non-normalized anomaly scores that exceeds a tail threshold according to a peak over-threshold (POT). Parameters of a probability density function are trained according to EVT based on the highest subset of non-normalized abnormal scores. After training and in a production environment, a normalized anomaly score is generated based on the non-normalized anomaly score and trained parameters of the probability density function. Anomaly detection compares the normalized anomaly score to an optimized anomaly threshold.

Description

Technical Field

[0001] The present invention relates to threshold estimation and calibration for anomaly detection. This paper is a machine learning (ML) and extreme value theory (EVT) technique for normalizing and thresholding anomaly scores without presume the value distribution. Background Art

[0002] Anomaly detection has attracted considerable attention in the industry due to its importance in protecting computer systems from harmful activities, either malicious or accidental. Databases are vulnerable to various types of attacks and malicious activities. Machine learning (ML) algorithms that analyze database logs play an important role in detecting such activities. Logs represent a structured sequence of data consisting of messages, where each message consists of attributes.

[0003] Many anomaly detection methods rely on predefined thresholds, which are usually selected subjectively by human experts or automatically based on assumptions about the statistical distribution of the data. In the case of incorrect threshold selection or distribution assumptions, anomaly detection accuracy may deteriorate significantly.

[0004] Anomaly detection is not always based on ML models that compute anomaly scores. Some methods use raw data directly without any transformation. In any case, anomaly detection is usually performed by comparing anomaly scores or raw data with subjectively set thresholds or by fitting an assumed distribution to the available data and evaluating the corresponding likelihood. Scoring methods are highly sensitive to the choice of anomaly thresholds. If the threshold is too high, there is a risk of too many false negatives. Similarly, if the anomaly threshold is too low, there is a risk of too many false positives.

[0005] Non-scoring methods often suffer from the problem of inadequate assumed statistical distributions, such as highly idealized Gaussian models. Accurate estimates of low probability regions (the tails of distributions) are particularly important for anomaly detection, since anomalies occur in these regions. In most cases, accurate predictions of the tails are impossible with the current state of the art, since extreme data points are rare, which makes the estimate of any assumed distribution dominated by normal data that is less important for anomaly detection. BRIEF DESCRIPTION OF THE DRAWINGS

[0006] In the attached picture:

[0007] Figure 1 is a block diagram depicting an example computer for providing automatic calibration for anomaly detection based on machine learning (ML) and extreme value theory (EVT) techniques for normalizing and thresholding anomaly scores without assuming a value distribution;

[0008] Figure 2 is a flow chart depicting an example computer process for anomaly score normalization based on a peak over threshold (POT) for EVT;

[0009] Figure 3 is a flow chart depicting an example computer process for anomaly score normalization based on maximum likelihood estimation (MLE);

[0010] Figure 4 is a flow chart depicting an example computer process for tuning density function parameters for anomaly score normalization;

[0011] Figure 5 is a flow chart depicting an example computer process for generating a training corpus of unnormalized anomaly scores for training density function parameters;

[0012] Figure 6 is a block diagram illustrating a computer system upon which embodiments of the present invention may be implemented;

[0013] Figure 7 is a block diagram illustrating a basic software system that may be used to control the operation of a computing system. DETAILED DESCRIPTION

[0014] In the following description, for the purpose of explanation, many specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent that the present invention can be practiced without these specific details. In other cases, well-known structures and devices are shown in block diagram form to avoid unnecessarily obscuring the present invention.

[0015] General Overview

[0016] This paper is an anomaly detection method that addresses the shortcomings of prior art calibration. This method is based on extreme value theory (EVT) that does not require any statistical distribution assumptions. The improved choice of anomaly thresholds in this paper improves anomaly detection accuracy. In an embodiment, this method is applied to data from database command logs. However, the proposed method is not database-specific and can be applied to other types of logs or data.

[0017] In an embodiment, the anomaly scoring model learns to reconstruct a workload that represents normal database activity. Input feature vectors corresponding to normal activity result in a lower reconstruction error, while feature vectors representing anomalies result in a higher reconstruction error. The reconstruction error is used as a raw anomaly score. The higher the score, the more abnormal the input. The raw anomaly score is normalized and then compared to an anomaly detection threshold selected using cross-validation. Scores above the threshold are marked as anomalies. Normalization is required to bring unbounded scores to a uniform range, making the selection of anomaly thresholds more reliable and enabling comparison of different models that produce anomaly scores.

[0018] EVT improves the analysis of rare events, including modeling the asymptotic distribution of extreme events without a strong hypothesis about the original statistical distribution. In other words, EVT is more flexible than existing techniques, which improves anomaly detection accuracy. EVT facilitates extrapolation beyond the scope of available data, which makes EVT well suited for detecting new and more bizarre kinds of attacks. In other words, EVT can make anomaly detection somewhat forward-looking for evolving threats.

[0019] The raw (i.e., unnormalized) anomaly scores are used to estimate the parameters of the extreme value distribution. Once estimated, the distribution is used to normalize the anomaly scores. This approach ensures accurate anomaly scoring for data that falls in the tail of the score distribution.

[0020] EVT has not been used in the context of anomaly detection based on data collected from application logs (such as database command logs or application console logs). Log-based data has different statistical properties than the data that has been used for state-of-the-art EVT. This paper computes anomaly scores based on a given data source and an autoencoder trained to discover and analyze the semantics of application-specific logs.

[0021] While EVT has been applied to anomaly detection in several limited ways, using EVT for anomaly score normalization is novel. This approach uses raw anomaly scores and estimates their tail distribution. An application-specific lower bound on the tail is found based on the Peak Over Threshold (POT) technique, which isolates all peak raw anomaly scores above a certain base level. Other methods are not based on POT because it is difficult to choose a suitable base threshold. The tail is modeled by combining the optimally found base threshold and the generalized Pareto distribution (GPD).

[0022] The ML-based anomaly detection pipeline in this paper has three main processing stages. The first stage is dedicated to feature extraction, where application logs are converted into numerical feature vectors. In the second stage, the ML model infers raw anomaly scores for the feature vectors. The scoring model can be a variant of an autoencoder, such as a variational or denoising autoencoder. The third stage detects anomalies based on anomaly score normalization as taught in this paper.

[0023] During anomaly detection, the raw anomaly score is compared with the optimally selected POT level. If the raw anomaly score is below this level, it is marked as non-abnormal without performing score normalization. Otherwise, the normalized anomaly score is calculated from the raw anomaly score. In other words, and according to POT, some anomaly scores are normalized, while others are not, which is a novel approach. By definition, most anomaly scores are normal (i.e., non-abnormal). Therefore, in this article, most raw anomaly scores do not need normalization, which accelerates anomaly detection. This acceleration promotes the asymmetric analysis of devoting more calculations to feature vectors as outliers and less calculations to normal feature vectors. The result is a better utilization of processing bandwidth in a way that reduces average latency and increases throughput (i.e., acceleration).

[0024] Another quantitative improvement is the improvement in anomaly detection accuracy. Experiments show that optimal EVT completely eliminates false positives without reducing the true positive rate. Therefore, the precision rate (i.e., positive predictive value, PPV) is improved, and the false discovery rate (FDR) is reduced. In other words, there are fewer false alarms, which means avoiding automatic (and manual) overreactions, which saves computer resources such as time and space. Therefore, the improved precision rate further provides computer speedup.

[0025] There are also qualitative improvements as follows.

[0026] Common anomaly detection threshold: Considering that the score values ​​are all mapped to the [0,1] range, score normalization reduces data variability. This facilitates the establishment of a common anomaly detection threshold and the subsequent comparison of different anomaly scoring models based on this common threshold.

[0027] Enhanced robustness: EVT does not require any strong assumptions about the data generating process, application / domain details, or statistical distribution.

[0028] Easy to use: Universal and straightforward to automatically apply to data from any application or domain,

[0029] Includes console logs, database command logs, and public cloud ecosystems.

[0030] Solid mathematical foundation: EVT has a rigorous mathematical theoretical system.

[0031] In an embodiment, a computer receives a number of unnormalized anomaly scores and selects a highest subset of unnormalized anomaly scores that exceed a tail threshold based on a peak overthreshold (POT). Based on the highest subset of unnormalized anomaly scores, parameters of a probability density function are trained based on extreme value theory (EVT). After training and in a production environment, a normalized anomaly score is generated based on the unnormalized anomaly scores and the trained parameters of the probability density function. Anomaly detection compares the normalized anomaly score to a universal anomaly threshold.

[0032] 1.0 Sample Computer

[0033] Figure 1 1 is a block diagram depicting an example computer 100 in an embodiment. The computer 100 provides automatic calibration for anomaly detection. The computer 100 uses machine learning (ML) and extreme value theory (EVT) techniques to normalize and threshold anomaly scores without assuming a value distribution. The computer 100 can be one or more of a rack server (such as a blade), a personal computer, a mainframe, a virtual computer, a smart phone, or other computing device.

[0034] 1.1 Black Box Model

[0035] In various embodiments, the computer 100 has hosted in its memory an anomaly scoring model 110, which may be any software component that accepts a feature vector 120 as input. Applying the anomaly scoring model 110 to the feature vector 120 causes the anomaly scoring model 110 to generate an unnormalized numerical anomaly score that measures how strange, abnormal, or suspicious the feature vector 120 is. For example, unnormalized anomaly scores 131-135 are generated for different instances of the feature vector 120 encoding the feature AE.

[0036] Each of the features AE may have corresponding semantics and data types, as discussed later herein. Different instances of feature vector 120 may have the same or different values ​​of features AE, which the anomaly scoring model 110 analyzes to infer unnormalized anomaly scores 131-135. In various cases, the anomaly scoring model 110 may or may not calculate similar or identical unnormalized anomaly scores for different instances of feature vector 120.

[0037] In various embodiments, the anomaly scoring model 110 is based on or not based on machine learning (ML). In either case, the anomaly scoring model 110 may or may not have a black box architecture that is unknown, opaque, or confusing in a manner that more or less hinders direct inspection of the internal operations of the anomaly scoring model 110. In an embodiment not shown, the anomaly scoring model 110 is hosted in a different computer than the computer 100, and the computer 100 applies the techniques herein by remotely using the anomaly scoring model 110. For example, the computer 100 may send the feature vector 120 to the anomaly scoring model 110 over a communication network, and receive an unnormalized anomaly score in response over the communication network.

[0038] In various embodiments, the anomaly scoring model 110 can be an ML model, such as a k-nearest neighbor (KNN), an isolation forest, a support vector machine (SVM), an autoencoder or other artificial neural network (ANN), a Bayesian network, or a principal component analysis (PCA). If the anomaly scoring model 110 is an ML model, then in this example, the anomaly scoring model 110 has been trained. Various example ML model architectures and ML training are discussed later in this document.

[0039] 1.2 Feature Engineering

[0040] The feature vector 120 contains a corresponding value for each of the features AE. Each of the features AE has a corresponding data type. For example, the feature AB may have the same or different corresponding data types. The data types may variously be: a) numbers that are integers or real numbers, b) primitive types that can be easily encoded as numbers (such as Boolean values ​​or text characters), c) sequences of discrete values ​​with semantic ordering such as text literals (such as months), which can be easily encoded as corresponding numbers preserving the original ordering, or d) categories that enumerate different categorical values ​​that are semantically unordered.

[0041] Categories are prone to discontinuities that may or may not appear to destabilize the anomaly scoring model 110, such that different categorical values ​​for the same feature may or may not cause the anomaly scoring model 110 to generate very different unnormalized anomaly scores. A categorical feature may be hash-encoded as one number in the feature vector 120, or n-hot or 1-hot encoded as multiple numbers. For example, 1-hot encoding generates one for categorical values ​​that actually appear in the feature vector 120, and also generates zeros for each possible categorical value that does not appear in the feature vector 120.

[0042] The feature vector 120 can represent various objects in various embodiments. For example, the feature vector 120 can be or represent a network packet, a record (such as a database table row), a command (such as a shell command or a database statement), or a log entry (such as a line of text in a console output log file). Similarly, the feature AE can be a corresponding data field, attribute, or column that can appear in each object instance. For example, the unnormalized anomaly score 135 can indicate whether the feature vector 120 is abnormal (such as based on a threshold). When the computer 100 detects an anomaly in a production environment, an alarm can be generated to trigger a manual or automated security response, such as terminating a session or network connection, refusing further processing and / or recording of the feature vector 120, transferring and / or alerting the feature vector 120 for more intensive manual or automatic inspection and analysis.

[0043] 1.3 Unnormalized Anomaly Scores from Anomaly Scoring Models

[0044] Various embodiments of the anomaly scoring model 110 may generate various corresponding distributions of unnormalized anomaly scores for the same set of instances of the feature vectors 120. For example, different instances of the anomaly scoring model 110 may each have: a) different ranges of possible unnormalized anomaly scores, b) different numeric data types for the unnormalized anomaly scores, c) different value distributions of anomaly scores, d) different internal architectures, e) the same architecture with different configuration values ​​(such as for hyperparameters), and / or f) trained with different training corpora. Due to those factors (a)-(f), different instances of the anomaly scoring model 110 may generate different corresponding unnormalized anomaly scores for the same instance of the feature vector 120.

[0045] In any case, it is invariant that anomaly instances of feature vector 120 have higher unnormalized anomaly scores than non-anomalous instances when the unnormalized anomaly scores are generated by the same instance of anomaly scoring model 110. Therefore, the anomaly threshold can distinguish anomaly instances from non-anomalous instances. Factors (a)-(f) prevent the prior art from establishing a universal anomaly threshold as a predefined numerical constant that can be used with different instances of anomaly scoring model 110.

[0046] Prior art techniques resort to heuristics and / or human expert intuition to define anomaly thresholds for instances of anomaly scoring model 110, which must be repeated for each instance of anomaly scoring model 110 in a brittle and unreliable manner due to factors (a)-(f). In many cases, heuristics require analysis and / or assumptions about the distribution of values ​​in the training corpus. Computer 100 has novel automation for establishing anomaly thresholds for instances of anomaly scoring model 110 without the need to analyze and / or assume the distribution of values ​​in the training corpus. This approach is robust despite factors (a)-(f).

[0047] 1.4 Extreme Value Theory (EVT) and Peak Over Threshold (POT)

[0048] This approach requires two complementary techniques, namely, reliable normalization of anomaly scores based on extreme value theory (EVT) and robust calculation of anomaly thresholds based on the reliable normalized anomaly scores. The unnormalized anomaly scores 131-134 can be sorted from left to right in ascending value, as shown, such that the unnormalized anomaly score 131 is the lowest and the unnormalized anomaly score 134 is the highest. Based on this sorting, most of the unnormalized anomaly scores are naturally low and located on the left because anomalies are rare.

[0049] Also based on this ranking, the statistical distribution of the unnormalized anomaly scores 131-134 is a curve with its top (i.e., the statistical mode) close to the left and a long tail on the right because anomalies are rare. In other words, the curve has a positive skewness. All unnormalized anomaly scores to the left of the top / mode or near the top / mode are non-anomalous. The tail on the right contains a mixture of abnormal and almost abnormal unnormalized anomaly scores.

[0050] According to the peak overthreshold (POT), any unnormalized anomaly score that exceeds the tail threshold is classified as a member of the tail on the right, shown as tail 142. In an embodiment, tail 142 is the highest quantile, and the tail threshold is the lower bound of the highest quantile. Any unnormalized anomaly score that does not exceed the tail threshold is classified as a member of subthreshold 141, which includes all quantiles except tail 142. For example, tail 142 can be a decile, in which case subthreshold 141 contains nine deciles and 90% of the unnormalized anomaly scores.

[0051] Tail 142 should be overly inclusive and the tail threshold should be low enough to include some non-anomalous scores in tail 142. For example, even if unnormalized anomaly score 133 is classified into tail 142, computer 100 can perform score normalization to detect that unnormalized anomaly score 133 is actually non-anomalous. Optimal calibration by validation is discussed later in this article.

[0052] 1.5 Density function

[0053] EVT fits probability density function 151 to tail 142 by training parameters 160, as discussed later herein. Reliable normalization of the anomaly score is achieved by any of density functions 151-152, and in embodiments explained later herein, cumulative density function 152 may be based on probability density function 151. Any or both of density functions 151-152 may use numerical parameters 160 mathematically.

[0054] In an embodiment, probability density function 151 is the following generalized Pareto distribution (GPD), and parameters 160 include individual parameters 171 - 173 .

[0055]

[0056] The following terms have the following meanings in the above GPD.

[0057] x is any one of the unnormalized anomaly scores 131-135.

[0058] μ is the position 171 in the parameter 160 .

[0059] · Scaling 172 in the σ parameter 160 .

[0060] ·ξ is the shape 173 in parameter 160.

[0061] In an embodiment explained later herein, the parameters 171 - 173 are trained with the probability density function 151 , and then the already trained parameters 171 - 173 are reused for the following cumulative density function 152 .

[0062]

[0063] In the above cumulative density function 152, f(x) is the normalized anomaly score. For example, x may be the unnormalized anomaly score 135, and f(x) may be the normalized anomaly score 180.

[0064] 2.0 Example Anomaly Detection Processing Based on Normalization

[0065] Figure 2 is a flow chart depicting an example process that an embodiment of the computer 100 may perform for anomaly score normalization based on peak overthreshold (POT) for extreme value theory (EVT). Figure 1 discuss Figure 2 .

[0066] Figure 2The process has two stages. Steps 201-203 train the parameters 160, which can occur in a lab environment. Steps 204-205 use the trained parameters 160 in a production environment.

[0067] Step 201 obtains (e.g., receives or generates) a training corpus containing unnormalized anomaly scores 131-134 inferred or inferred by an already trained anomaly scoring model 110. In an embodiment, step 201 may generate a training corpus consisting only of unnormalized anomaly scores using the anomaly scoring model 110. For example, the training corpus may be a second training corpus derived by applying the anomaly scoring model 110 to a first training corpus that lacks anomaly scores and consists of tuples such as messages discussed later herein.

[0068] Step 202 sorts the unnormalized anomaly scores 131-134 and selects the highest subset of unnormalized anomaly scores that exceed a tail threshold. For example, step 202 defines tail 142 as containing unnormalized anomaly scores 133-134.

[0069] Based on tail 142, which is the highest subset of unnormalized anomaly scores, step 203 trains parameters 160 in probability density function 151. Step 203 learns the values ​​of parameters 171-173 using techniques such as method of moments (MOM), probability weighted moments (PWM), or other methods as discussed later in this document.

[0070] Steps 204-205 are performed in production after training parameters 160 is completed. Step 204 receives a new unnormalized anomaly score 135, such as a new instance for a feature vector 120, directly from anomaly scoring model 110, which may or may not be real-time, such as received in real-time in a stream. Step 204 detects whether the unnormalized anomaly score 135 exceeds a tail threshold. In other words, step 204 detects: a) whether the unnormalized anomaly score 135 is within the range of the tail 142, which is the same as b) whether the unnormalized anomaly score 135 is a peak over threshold (POT).

[0071] If the unnormalized anomaly score 135 does not exceed the tail threshold, then the unnormalized anomaly score 135 is not anomalous and will not be normalized, in which case, Figure 2 Otherwise, the unnormalized anomaly score 135 may or may not be anomaly, and step 205 occurs using the parameters 160 trained in step 203 .

[0072] The instances of the unnormalized anomaly scores 135 and / or feature vectors 120 may be new and may not have existed during the training steps 201 - 203. Based on the unnormalized anomaly scores 135, the parameters 160, and the density functions 151 or 152, step 205 generates a normalized anomaly score 180 for the unnormalized anomaly scores 135, as discussed later herein.

[0073] In an embodiment, the normalized anomaly score 180 from step 205 is compared to a numerical universal anomaly threshold or an anomaly threshold established empirically through cross-validation. If the anomaly threshold is exceeded, the computer 100 classifies the new instance of the feature vector 120 as an anomaly. The computer 100 may react by treating the anomaly instance of the feature vector 120 in a special way, such as alerting it for human attention, logging it for later in-depth analysis, rejecting it and not processing it further, processing it further with enhanced security (such as fewer permissions), and / or adding it to the training corpus for later retraining of the anomaly scoring model 110 and / or parameters 160.

[0074] 3.0 Example Normalization Based on Maximum Likelihood Estimation (MLE)

[0075] Figure 3 is a flow chart depicting an example process that an embodiment of computer 100 may perform for training of anomaly score normalization based on maximum likelihood estimation (MLE). Figure 1 discuss Figure 3 . Figure 2-Figure 3 The processing steps may be combined or interleaved.

[0076] The training step 302 may occur in a laboratory environment. Step 306 uses the trained parameters 160, such as in a production environment.

[0077] Based on probability density function 151 and the following MLE formula, step 302 trains parameters 171 - 173 by fitting tail 142 to the following MLE formula.

[0078]

[0079] The following terms have the following meanings in the above MLE formula.

[0080] t is the tail threshold, ie, the lower bound defining the range of the tail 142 .

[0081] ·N t are counts of peaks exceeding threshold (POT), which are all unnormalized anomaly scores in the tail 142.

[0082] ·Y iis how much the i-th unnormalized anomaly score in the tail 142 exceeds the tail threshold t.

[0083] σ is the scaling 172 in the parameter 160 .

[0084] γ is a well-known extreme value index.

[0085] After step 302, parameters 160 are immutable. Based on the trained parameters 160, step 304 configures the cumulative density function 152 by using parameters 171-173 as constants.

[0086] Step 306 occurs in production after training parameters 160 is completed. Step 306 receives new unnormalized anomaly scores 135, such as new instances for feature vectors 120, directly from anomaly scoring model 110, which may be real-time, such as received in real-time in a stream. Step 306 calculates normalized anomaly scores 180 by applying cumulative density function 152 with trained parameters 160 to unnormalized anomaly scores 135.

[0087] 4.0 Example Parameter Tuning Process

[0088] Figure 4 is a flow chart depicting an example process that an embodiment of computer 100 may perform to tune parameters 160 for anomaly score normalization. Figure 1 discuss Figure 4 . Figure 2-Figure 4 The processing steps may be combined or interleaved.

[0089] Tuning steps 402 and 404 can occur in a laboratory environment and be repeated iteratively for each of a plurality of predefined tail thresholds in order to empirically discover which is the optimal tail threshold. Each iteration performs steps 402 and 404 in sequence with a different current tail threshold. Because each iteration is independent, multiple iterations can occur concurrently.

[0090] In an embodiment, each predefined tail threshold has a different numerical precision. For example, the predefined tail threshold may be at least two of the following: 0.9, 0.99, 0.999, and 0.9999.

[0091] Based on the current tail threshold, step 402 selects the tail 142 that is the highest subset of the unnormalized anomaly score and trains the parameters 160 of the probability density function 151, as discussed earlier herein. Because the current tail threshold is different in each iteration, the tail 142 may or may not be different in each iteration. If the current tail threshold is increased in each iteration, then the current tail 142 is a subset (not necessarily a true subset) of the previous tail 142.

[0092] Between steps 402 and 404 in each iteration, parameters 160 are trained based on probability density function 151 and current tail 142, as discussed previously herein. Step 404 measures the numerical fit score of the trained parameters 160 for the current tail 142. In various embodiments, step 404 applies a Kolmogorov-Smirnov test, an Anderson-Darling test, or a quantile-quantile (QQ) plot to measure goodness of fit.

[0093] After the iteration ends and before step 406, computer 100 detects which tail threshold in which iteration provides the best (e.g., highest) fit score. Based on detecting which iteration is best, computer 100 selects the tail threshold and parameters 160 for that iteration as the optimal configuration for the production environment.

[0094] In a production environment, step 406 generates normalized anomaly scores 180 from unnormalized anomaly scores 135 using the selected optimal configuration (including tail thresholds and parameters 160 ), as discussed previously herein.

[0095] 5.0 Example of unnormalized score handling

[0096] Figure 5 is a flow chart depicting an exemplary process that an exemplary embodiment of computer 100 may perform to generate a training corpus of unnormalized anomaly scores for training parameters 160. This exemplary process and the design choices in the exemplary embodiment are illustrative and not limiting of the embodiments presented previously herein. Figure 1 discuss Figure 5 . Figure 2-Figure 5 The processing steps may be combined or interleaved.

[0097] As explained previously herein, the unnormalized anomaly scores 131-135 are generated by the anomaly scoring model 110. In an embodiment, the anomaly scoring model 110 is a trainable regression or other machine learning (ML) model.

[0098] Training the anomaly scoring model 110 is the first training that occurs during step 502 . Figure 5 The processing of occurs before the training parameters 160 as the second training. The first training uses a first training corpus of domain-specific tuples, as discussed elsewhere herein. The second training uses the unnormalized anomaly scores 131-134 as the second training corpus, as discussed earlier herein.

[0099] In this example, step 502 unsupervisedly trains the anomaly scoring model 110 without an anomaly threshold. The unsupervised training uses a training corpus of tuples without labels and encoded as instances of feature vectors 120. The labels are known correct unnormalized anomaly scores for the tuples.

[0100] When training the anomaly scoring model 110 begins, the anomaly scoring model 110 generates unnormalized anomaly scores that are more or less inaccurate. When training is complete, the anomaly scoring model 110 generates unnormalized anomaly scores that are more or less accurate instead.

[0101] In this example, the anomaly scoring model 110 is unsupervised and reconstructive. The reconstructive anomaly scoring model infers two outputs: an unnormalized anomaly score and a regenerated input that is a more or less imperfect copy of the actual / original input.

[0102] 5.1 Autoencoder

[0103] In an embodiment, the reconstructive anomaly scoring model 110 is an autoencoder. Back-propagation training of an artificial neural network (ANN) such as an autoencoder, as discussed later herein, can be driven by model error. For supervised training, model error can be measured by comparing the inferences of the ML model to predefined labels that have been established as correct inferences. For unsupervised training (such as using an autoencoder), predefined labels may not be available, and errors can be measured instead based on diagnostic outputs from the autoencoder, as shown below.

[0104] In an embodiment, the autoencoder can be a multi-layer perceptron (MLP). Unlike anomaly scoring, classification requires associating inferred labels with complex inputs. In other words, classification requires recognizing learned patterns. Anomaly scoring, on the other hand, recognizes that the input does not match any learned pattern. The input is an instance of feature vector 120.

[0105] Autoencoders provide dimensionality reduction that: a) allows analysis and integration of irrelevant features of the input to be avoided, and b) generates a more concise internal neural representation of the input, where only meaningful input features are retained. In other words, autoencoders extract semantic details of complex, noisy, and ambiguous inputs. Thus, autoencoders convert a sparse representation of the input into a dense encoding. Features and feature representations are discussed later in this article.

[0106] Generally during training, the autoencoder learns which features should be downplayed and how to encode the semantic features that should be retained. The autoencoder in this paper is also a reconstructive model because the autoencoder contains additional neural layers that are trained to regenerate the original input. In other words, the autoencoder encodes the input into a semantic encoding, and then the autoencoder further decodes it back into a more or less accurate copy of the input.

[0107] In an embodiment, the reconstructive anomaly scoring model 110 is instead a principal component analysis (PCA). Although very different in operation from an autoencoder, PCA is a reconstructive model that functions similarly to an autoencoder, as shown below. Similar to an autoencoder, PCA is trained unsupervised to learn dimensionality reduction and minimize reconstruction error. The architecture of PCA and autoencoders will be discussed later in this article.

[0108] 5.2 Reconstruction Error

[0109] The measured difference between the original input and the regenerated input is called the reconstruction error. Because the original input and the regenerated input are composed of individual features AE, the difference between the original feature and the reconstructed feature can be measured to calculate the corresponding reconstruction error of the feature. In other words, the corresponding reconstruction error can be measured for each of the features AE in the instance of the feature vector 120. The original value of the feature can be compared with the reconstructed value to calculate a numerical score that measures the magnitude of the difference between the original value of the feature and the reconstructed value.

[0110] The loss can be calculated using the integral (such as sum or average) of the corresponding reconstruction errors of all features AE, which measures how much relevant information the reconstructive anomaly scoring model 110 loses when inferring the input. As discussed below, the loss can indicate the reconstruction error that occurs in the regenerated input compared to the original input as an instance of the feature vector 120. The loss is informally or mathematically opposite to the inference accuracy. That is, the higher the loss, the lower the reliability of the reconstructive anomaly scoring model 110 in identifying the input. A high loss (such as exceeding an anomaly threshold) can indicate that the input is abnormal.

[0111] The reconstruction error can be used as a substitute for the inference error. This use of the reconstruction error is particularly important for unsupervised learning, since the inference error may be more or less impossible to measure without predefined labels. Therefore, the reconstruction error (rather than the inference error) can be used for unsupervised learning of reconstructive models, such as backpropagation for unsupervised training of autoencoders.

[0112] In an embodiment, step 502 has a training threshold that can be used to detect training convergence and, when exceeded, stops the training of the anomaly scoring model 110. In various embodiments, the training threshold is an accuracy threshold or a reconstruction error threshold. The training threshold is not an anomaly threshold used to compare with the unnormalized anomaly score.

[0113] 5.3 Domain-specific features

[0114] The complex input is provided as an instance of a feature vector 120, which contains the corresponding values ​​of each of all features AE. In one embodiment, the feature vector 120 is homogeneous, so that the corresponding values ​​of all features are encoded as the same data type, such as the same primitive data type (such as integers) or unit-normalized real numbers (such as floating points). In one embodiment, the feature vector 120 is heterogeneous, and each feature can have its own corresponding data type.

[0115] In an embodiment, ordinal features such as calendar months may be encoded as zero-or-one based unsigned integers such as 1-12, instead of as text strings such as January. In an embodiment, categorical features such as features of unordered and mutually exclusive choices such as tea flavors may be so-called one-hot encoded as a set of mutually exclusive Boolean features. For example, a choice of one of three flavors may be encoded as three Boolean features where the corresponding feature is true in the feature vector and the other two Boolean features are false. In an embodiment, Boolean features are encoded as numbers.

[0116] Steps 502 and 504 may use the same, partially overlapping, or non-overlapping different training tuple corpora. Step 504 populates an instance of feature vector 120 with domain-specific features. In one embodiment, feature vector 120 is an encoding of a database sentence.

[0117] For example, features AE may be: a timestamp of a database statement, an identifier of a database session, a network address of a database client, an identifier of an operating system (OS) of a database client, and at least a portion of a database statement, respectively. The following are example features that may appear in a tuple, each tuple representing a corresponding database statement in real time or stored in a log of a database server.

[0118] All or part of an Open Database Connectivity (ODBC) or Java ODBC (JDBC) Uniform Resource Locator (URL) used to establish a network connection and database session. Example connection string portions include standard URL portions (e.g., protocol, server host, and network port number) and ODBC / JDBC-specific portions of the path or query parameters, such as the name of the database, schema, or user account.

[0119] An indication of how old the database session that issued the database statement is.

[0120] One-hot encodings of dialects of Structured Query Processing Language (SQL) for database statements such as Data Definition Language (DDL), Data Manipulation Language (DML), Data Query Language (DQL), and Transaction Control Language (TCL).

[0121] One-hot encodings of database statement verbs such as SELECT, INSERT, DELETE, UPDATE, CREATE, DROP, GRANT, BEGIN, and COMMIT.

[0122] n-hot encoding of the state or context of a database statement (such as: outside a transaction, inside a demarcated transaction, autocommitted transactions, and prepared statements).

[0123] Return codes from database statements, such as error codes.

[0124] A count of the number of rows in the result set returned by a database statement.

[0125] n-hot encodings of database tables referenced by database statements.

[0126] Details of the WHERE clause, such as the count of joins specified, the LIMIT clause on the results, the sort direction, and the DISTINCT keyword.

[0127] Step 506 generates unnormalized anomaly scores 131-134 by applying anomaly scoring model 110 to the instance of feature vector 120 provided in step 504. Unnormalized anomaly scores 131-134 may be used to train parameters 160, as discussed previously herein.

[0128] 6.0 Database Overview

[0129] Embodiments of the present invention are used in the context of a database management system (DBMS). Accordingly, a description of an example DBMS is provided.

[0130] Generally speaking, a server (such as a database server) is a combination of integrated software components and allocations of computing resources (such as memory, nodes, and processes on the nodes for executing the integrated software components), where the combination of software and computing resources is dedicated to providing a specific type of functionality on behalf of the server's clients. A database server governs and facilitates access to a specific database, processing client requests to access the database.

[0131] A user interacts with the database server of a DBMS by submitting commands to the database server, which cause the database server to perform operations on the data stored in the database. A user may be one or more applications running on a client computer that interacts with the database server. Multiple users may also be collectively referred to as users in this article.

[0132] A database consists of data stored on a persistent storage mechanism (such as a collection of hard disks) and a database dictionary. A database is defined by its own separate database dictionary. The database dictionary includes metadata that defines the database objects contained in the database. In fact, the database dictionary defines most of the contents of the database. Database objects include tables, table columns, and tablespaces. A tablespace is a collection of one or more files used to store data for various types of database objects (such as tables). If the data for a database object is stored in a tablespace, then the database dictionary maps the database object to one or more tablespaces that hold the data for the database object.

[0133] The DBMS consults the database dictionary to determine how to execute database commands submitted to the DBMS. Database commands can access database objects defined by the dictionary.

[0134] Database commands can be in the form of database statements. In order for a database server to process a database statement, the database statement must conform to a database language supported by the database server. A non-limiting example of a database language supported by many database servers is SQL, including proprietary forms of SQL supported by database servers such as Oracle (such as Oracle Database 11g). SQL data definition language ("DDL") instructions are issued to a database server to create or configure database objects, such as tables, views, or complex types. Data manipulation language ("DML") instructions are issued to a DBMS to manage data stored in a database structure. For example, SELECT, INSERT, UPDATE, and DELETE are examples of common DML instructions in some SQL implementations. SQL / XML is a common extension of SQL used when manipulating XML data in an object-relational database.

[0135] A multi-node database management system consists of interconnected nodes that share access to the same database. Typically, the nodes are interconnected via a network and share access to shared storage to varying degrees, such as sharing access to a collection of disk drives and the data blocks stored thereon. The nodes in a multi-node database system may be in the form of a group of computers, such as workstations and / or personal computers, interconnected via a network. Alternatively, the nodes may be nodes of a grid consisting of nodes in the form of server blades interconnected to other server blades on a rack.

[0136] Each node in a multi-node database system hosts a database server. A server, such as a database server, is a combination of integrated software components and an allocation of computing resources, such as memory, nodes, and processes on nodes for executing the integrated software components on processors, that are dedicated to performing specific functions on behalf of one or more clients.

[0137] Resources from multiple nodes in a multi-node database system can be allocated to software running a particular database server. Each combination of allocation of software and resources from a node is a server referred to herein as a "server instance" or "instance." A database server may include multiple database instances, some or all of which run on separate computers (including separate server blades).

[0138] 6.1 Query Processing

[0139] A query is an expression, command, or set of commands that, when executed, causes a server to perform one or more operations on a collection of data. A query may specify (one or more) source data objects, such as (one or more) tables, (one or more) columns, (one or more) views, or (one or more) snapshots, from which (one or more) result sets are to be determined. For example, (one or more) source data objects may appear in the FROM clause of a Structured Query Language ("SQL") query. SQL is a well-known example language for querying database objects. As used herein, the term "query" is used to refer to any form of representation of a query, including queries in the form of database statements and any data structure used for internal query representation. The term "table" refers to any source object that is referenced or defined by a query and represents a collection of rows, such as a database table, a view, or an inline query block (such as an inline view or a subquery).

[0140] The query may perform operations on data from the source data object(s) row by row as the object(s) are loaded, or on the entire source data object(s) after the object(s) have been loaded. The result set generated by some operation(s) may be made available to other operations(s), and in this manner, the result set may be filtered out or narrowed down based on certain criteria, and / or joined or combined with other result set(s) and / or other source data object(s).

[0141] A subquery is a portion or component of a query that is distinct from and can be evaluated separately from (i.e., as a separate query) the other portion(s) or component(s) of the query. The other portions or components of the query may form an outer query, which may or may not include other subqueries. A subquery nested within an outer query may be evaluated separately one or more times when computing results for the outer query.

[0142] Generally speaking, a query parser receives a query statement and generates an internal query representation of the query statement. Typically, the internal query representation is a collection of interrelated data structures that represent various components and structures of the query statement.

[0143] The internal query representation may be in the form of a graph of nodes, with each interrelated data structure corresponding to a node and a component of the query statement being represented. The internal representation is typically generated in memory for evaluation, manipulation, and transformation.

[0144] Hardware Overview

[0145] According to one embodiment, the techniques described herein are implemented by one or more special-purpose computing devices. Special-purpose computing devices may be hardwired to perform these techniques, or may include digital electronic devices (such as one or more application-specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs) that are permanently programmed to perform these techniques), or may include one or more general-purpose hardware processors that are programmed to perform these techniques according to program instructions in firmware, memory, other storage devices, or combinations. Such special-purpose computing devices may also combine customized hard-wired logic, ASICs, or FPGAs with custom programming to implement these techniques. Special-purpose computing devices may be desktop computer systems, portable computer systems, handheld devices, networking devices, or any other devices that combine hard-wiring and / or program logic to implement these techniques.

[0146] For example, Figure 6 6 is a block diagram illustrating a computer system 600 upon which embodiments of the present invention may be implemented. Computer system 600 includes a bus 602 or other communication mechanism for communicating information, and a hardware processor 604 coupled to bus 602 for processing information. Hardware processor 604 may be, for example, a general purpose microprocessor.

[0147] The computer system 600 also includes a main memory 606, such as a random access memory (RAM) or other dynamic storage device, coupled to the bus 602 for storing information and instructions to be executed by the processor 604. The main memory 606 may also be used to store temporary variables or other intermediate information during the execution of instructions executed by the processor 604. When stored in a non-transitory storage medium accessible to the processor 604, these instructions cause the computer system 600 to become a special-purpose machine customized to perform the operations specified in the instructions.

[0148] Computer system 600 also includes a read only memory (ROM) 608 or other static storage device coupled to bus 602 for storing static information and instructions for processor 604. A storage device 610, such as a magnetic disk, optical disk, or solid state drive, is provided and coupled to bus 602 for storing information and instructions.

[0149] The computer system 600 may be coupled to a display 612, such as a cathode ray tube (CRT), via the bus 602 for displaying information to a computer user. An input device 614, including alphanumeric and other keys, is coupled to the bus 602 for communicating information and command selections to the processor 604. Another type of user input device is a cursor control 616, such as a mouse, trackball, or cursor direction keys, for communicating direction information and command selections to the processor 604 and for controlling cursor movement on the display 612. Such input devices typically have two degrees of freedom in two axes, a first axis (e.g., x) and a second axis (e.g., y), which facilitates the device to specify a position in a plane.

[0150] Computer system 600 may implement the techniques described herein using custom hardwired logic, one or more ASICs or FPGAs, firmware, and / or program logic that is combined with a computer system to make or program computer system 600 into a special purpose machine. According to one embodiment, computer system 600 performs the described techniques in response to processor 604 executing one or more sequences of one or more instructions contained in main memory 606. These instructions may be read into main memory 606 from another storage medium, such as storage device 610. Execution of the sequences of instructions contained in main memory 606 causes processor 604 to perform the process steps described herein. In alternative embodiments, hardwired circuitry may be used in place of or in combination with software instructions.

[0151] The term "storage medium" as used herein refers to any non-transitory medium that stores data and / or instructions that cause a machine to operate in a particular manner. Such storage media may include non-volatile media and / or volatile media. Non-volatile media include, for example, optical disks, magnetic disks, or solid state drives, such as storage device 610. Volatile media include dynamic memory, such as main memory 606. Common forms of storage media include, for example, floppy disks, flexible disks, hard disks, solid state drives, magnetic tapes or any other magnetic data storage media, CD-ROMs, any other optical data storage media, any physical media with a pattern of holes, RAM, PROMs and EPROMs, FLASH-EPROMs, NVRAMs, any other memory chips, or cassette tapes.

[0152] Storage media are distinct from but can be used in conjunction with transmission media. Transmission media participate in the transfer of information between storage media. For example, transmission media include coaxial cables, copper wire, and optical fiber, including the wires that comprise bus 602. Transmission media can also take the form of acoustic or light waves, such as those generated during radio wave and infrared data communications.

[0153] Various forms of media may be involved in transmitting one or more sequences of one or more instructions to the processor 604 for execution. For example, the instructions may initially be carried on a disk or solid-state drive of a remote computer. The remote computer may load the instructions into its dynamic memory and send the instructions over a telephone line using a modem. A modem local to the computer system 600 may receive the data on the telephone line and use an infrared transmitter to convert the data into an infrared signal. An infrared detector may receive the data carried in the infrared signal and appropriate circuitry may place the data on the bus 602. The bus 602 transfers the data to the main memory 606 from which the processor 604 retrieves and executes the instructions. The instructions received by the main memory 606 may optionally be stored on the storage device 610 before or after execution by the processor 604.

[0154] Computer system 600 also includes a communication interface 618 coupled to bus 602. Communication interface 618 provides bidirectional data communication coupled to network link 620, wherein network link 620 is connected to local network 622. For example, communication interface 618 can be an integrated services digital network (ISDN) card, a cable modem, a satellite modem, or a modem that provides a data communication connection with a corresponding type of telephone line. As another example, communication interface 618 can be a local area network (LAN) card to provide a data communication connection with a compatible LAN. A wireless link can also be implemented. In any such implementation, communication interface 618 sends and receives electrical signals, electromagnetic signals, or optical signals that carry digital data streams representing various types of information.

[0155] The network link 620 typically provides data communication to other data devices through one or more networks. For example, the network link 620 can provide a connection to a host computer 624 or to data equipment operated by an Internet Service Provider (ISP) 626 through a local network 622. The ISP 626 in turn provides data communication services through a global packet data communication network, now commonly referred to as the "Internet" 628. Both the local network 622 and the Internet 628 use electrical, electromagnetic, or optical signals that carry digital data streams. The signals through the various networks and the signals on the network link 620 and through the communication interface 618 (which carry the digital data to and from the computer system 600) are example forms of transmission media.

[0156] Computer system 600 can send messages and receive data, including program code, through the network(s), network link 620, and communication interface 618. In the Internet example, server 630 can send the requested code for an application program through Internet 628, ISP 626, local network 622, and communication interface 618.

[0157] The received code may be executed by processor 604 as it is received, and / or stored in storage device 610 or other non-volatile storage for later execution.

[0158] Software Overview

[0159] Figure 7 is a block diagram of a basic software system 700 that may be used to control the operation of the computing system 600. The software system 700 and its components, including their connections, relationships, and functions, are merely exemplary and are not meant to limit implementation of the example embodiment(s). Other software systems suitable for implementing the example embodiment(s) may have different components, including components with different connections, relationships, and functions.

[0160] Software system 700 is provided for directing the operation of computing system 600. Software system 700, which may be stored on system memory (RAM) 606 and fixed storage (eg, hard disk or flash memory) 610, includes a kernel or operating system (OS) 710.

[0161] OS 710 manages low-level aspects of computer operation, including managing the execution of processes, memory allocation, file input and output (I / O), and device I / O. One or more applications, represented as 702A, 702B, 702C ... 702N, may be "loaded" (e.g., transferred from fixed storage 610 into memory 606) for execution by system 700. Applications or other software intended for use on computer system 600 may also be stored as a downloadable set of computer-executable instructions, for example, for downloading and installation from an Internet location (e.g., a Web server, app store, or other online service).

[0162] The software system 700 includes a graphical user interface (GUI) 715 for displaying the software in a graphical manner (e.g.,

[0163] GUI 715 is used to receive user commands and data in the form of "clicks" or "touch gestures" (such as "clicks" or "touch gestures"). In turn, these inputs can be operated by system 700 according to instructions from operating system 710 and / or (one or more) applications 702. GUI 715 is also used to display the results of operations from OS 710 and (one or more) applications 702, on which the user can provide additional input or terminate the session (e.g., log out).

[0164] The OS 710 may execute directly on the bare hardware 720 (e.g., the processor(s) 604) of the computer system 600. Alternatively, a hypervisor or virtual machine monitor (VMM) 730 may be inserted between the bare hardware 720 and the OS 710. In this configuration, the VMM 730 acts as a software "buffer" or virtualization layer between the OS 710 and the bare hardware 720 of the computer system 600.

[0165] VMM 730 instantiates and runs one or more virtual machine instances ("clients"). Each client includes a "client" operating system (such as OS 710), and one or more applications (such as (one or more) applications 702) designed to execute on the client operating system. VMM 730 presents a virtual operating platform to the client operating system and manages the execution of the client operating system.

[0166] In some instances, VMM 730 can allow a guest operating system (OS) to run as if it were running directly on bare hardware 720 of computer system 600. In these instances, the same version of the guest operating system that is configured to execute directly on bare hardware 720 can also execute on VMM 730 without modification or reconfiguration. In other words, VMM 730 can provide full hardware and CPU virtualization to guest operating systems in some cases.

[0167] In other instances, the guest operating system may be specifically designed or configured to execute on VMM 730 to improve efficiency. In these instances, the guest operating system is "aware" that it is executing on a virtual machine monitor. In other words, VMM 730 may provide paravirtualization to the guest operating system in some cases.

[0168] A computer system process includes an allocation of hardware processor time, as well as an allocation of memory (physical and / or virtual), an allocation of memory for storing instructions executed by the hardware processor, for storing data generated by the execution of instructions by the hardware processor, and / or for storing hardware processor state (e.g., contents of registers) between allocations of hardware processor time when the computer system process is not running. A computer system process runs under the control of an operating system and may run under the control of other programs executing on the computer system.

[0169] cloud computing

[0170] The term "cloud computing" is used generally herein to describe a computing model that enables on-demand access to a shared pool of computing resources, such as computer networks, servers, software applications, and services, and allows resources to be rapidly provisioned and released with minimal management effort or service provider interaction.

[0171] A cloud computing environment (sometimes called a cloud environment or just a cloud) can be implemented in a variety of different ways to best suit different requirements. For example, in a public cloud environment, the underlying computing infrastructure is owned by an organization that makes its cloud services available to other organizations or the public. In contrast, a private cloud environment is generally intended for use by or within a single organization. A community cloud is intended to be shared by several organizations within a community; while a hybrid cloud includes two or more types of clouds (e.g., private, community, or public) bound together by data and application portability.

[0172] In general, the cloud computing model enables some of those responsibilities that might previously have been provided by an organization's own information technology department to instead be delivered as a service layer within a cloud environment for use by consumers (either internally or externally to the organization, depending on the public / private nature of the cloud). Depending on the specific implementation, the precise definition of the components or features provided by or within each cloud service layer may vary, but common examples include: Software as a Service (SaaS), in which consumers use software applications running on a cloud infrastructure, while the SaaS provider manages or controls the underlying cloud infrastructure and applications. Platform as a Service (PaaS), in which consumers can use software programming languages ​​and development tools supported by the supplier of the PaaS to develop, deploy, and otherwise control their own applications, while the PaaS provider manages or controls other aspects of the cloud environment (i.e., everything under the runtime execution environment). Infrastructure as a Service (IaaS), in which consumers can deploy and run arbitrary software applications, and / or provide processes, storage, networks, and other basic computing resources, while the IaaS provider manages or controls the underlying physical cloud infrastructure (i.e., everything below the operating system layer). Database as a Service (DBaaS), where the consumer uses a database server or database management system running on a cloud infrastructure, while the DbaaS provider manages or controls the underlying cloud infrastructure and applications.

[0173] The above basic computer hardware and software and cloud computing environment are given to illustrate the basic underlying computer components that can be used to implement (one or more) example embodiments. However, (one or more) example embodiments are not necessarily limited to any particular computing environment or computing device configuration. Instead, according to the present disclosure, (one or more) example embodiments can be implemented in any type of system architecture or processing environment that a person skilled in the art will understand in view of the present disclosure as being able to support the features and functions of (one or more) example embodiments given herein.

[0174] Machine Learning Models

[0175] A machine learning model is trained using a specific machine learning algorithm. Once trained, the input is applied to the machine learning model to make a prediction, which may also be referred to as a predicate output or output in this article. The attributes of the input may be referred to as features, and the values ​​of the features may be referred to as feature values ​​in this article.

[0176] A machine learning model includes a model data representation or model artifact. The model artifact includes parameter values, which may be referred to herein as theta values, and are applied to the input by the machine learning algorithm to generate a predicted output. Training a machine learning model requires determining theta values ​​of the model artifact. The structure and organization of theta values ​​depends on the machine learning algorithm.

[0177] In supervised training, training data is used by a supervised training algorithm to train a machine learning model. The training data includes inputs and "known" outputs. In an embodiment, the supervised training algorithm is an iterative process. In each iteration, the machine learning algorithm applies the model artifacts and inputs to generate a predicted output. The error or variance between the predicted output and the known output is calculated using an objective function. In practice, the output of the objective function indicates the accuracy of the machine learning model based on the specific state of the model artifacts in the iteration. By applying an optimization algorithm based on the objective function, the theta value of the model artifact can be adjusted. An example of an optimization algorithm is gradient descent. Iterations can be repeated until the desired accuracy is achieved or some other criterion is met.

[0178] In software embodiments, when a machine learning model is referred to as receiving inputs, executing and / or generating outputs or predicates, a computer system process executing a machine learning algorithm applies a model artifact to the inputs to generate a predicted output. A computer system process executes a machine learning algorithm by executing software configured to cause the algorithm to execute. When a machine learning model is referred to as performing an action, a computer system process executes a machine learning algorithm by executing software configured to cause the action to execute.

[0179] Inference requires a computer to apply a machine learning model to inputs such as feature vectors to generate inferences by processing the inputs and content of the machine learning model in an integrated manner. Inference is data-driven based on the data contained in the machine learning model (such as learned coefficients). In this article, this is referred to as inference through a machine learning model, and in fact, the inference is the computer executing the machine learning algorithm that processes the machine learning model.

[0180] Classes of problems that machine learning (ML) excels at include clustering, classification, regression, anomaly detection, prediction, and dimensionality reduction (i.e., simplification). Examples of machine learning algorithms include decision trees, support vector machines (SVMs), Bayesian networks, random algorithms such as genetic algorithms (GAs), and connectionist topologies such as artificial neural networks (ANNs). Implementations of machine learning can rely on matrices, symbolic models, and hierarchical and / or associative data structures. Parameterized (i.e., configurable) implementations of the best machine learning algorithms can be found in open source libraries such as Google's TensorFlow for Python and C++ or Georgia Tech's MLPack for C++. Shogun is an open source C++ ML library with adapters for several programming languages, including C#, Ruby, Lua, Java, Matlab, R, and Python.

[0181] Artificial Neural Networks

[0182] An artificial neural network (ANN) is a machine learning model that models, at a high level, a system of neurons interconnected by directed edges. An overview of neural networks is described in the context of a hierarchical feedforward neural network. Other types of neural networks share the properties of the neural networks described below.

[0183] In a layered feedforward network such as a multilayer perceptron (MLP), each layer comprises a group of neurons. A layered neural network comprises an input layer, an output layer, and one or more intermediate layers called hidden layers.

[0184] The neurons in the input layer and the output layer are referred to as input neurons and output neurons, respectively. Neurons in the hidden layer or the output layer may be referred to as activation neurons in this article. Activation neurons are associated with activation functions. The input layer does not contain any activation neurons.

[0185] From each neuron in the input layer and hidden layer, there is one or more directed edges to the activated neuron in the subsequent hidden layer or output layer. Each edge is associated with a weight. The edge from a neuron to an activated neuron represents the input from the neuron to the activated neuron, as adjusted by the weight.

[0186] For a given input to a neural network, each neuron in the neural network has an activation value. For an input neuron, the activation value is simply the input value for that input. For an activation neuron, the activation value is the output of the corresponding activation function that activated the neuron.

[0187] Each edge from a particular neuron to an activated neuron represents that the activation value of the particular neuron is the input to the activated neuron, i.e., the input to the activation function of the activated neuron, as adjusted by the weight of the edge. Thus, an activated neuron in a subsequent layer represents that the activation value of the particular neuron is the input to the activation function of the activated neuron, as adjusted by the weight of the edge. An activated neuron may have multiple edges pointing to the activated neuron, each edge representing that the activation value from the source origin neuron (as adjusted by the weight of the edge) is the input to the activation function of the activated neuron.

[0188] Each activated neuron is associated with a bias. To generate an activation value for an activated neuron, the neuron's activation function is applied to the weighted activation value and the bias.

[0189] Illustrative Data Structures for Neural Networks

[0190] Artifacts of a neural network may include matrices of weights and biases. Training a neural network may iteratively adjust the matrices of weights and biases.

[0191] For layered feedforward networks and other types of neural networks, the artifacts may include one or more matrices of edges W. Matrix W represents the edges from layer L-1 to layer L. If the number of neurons in layers L-1 and L is N[L-1] and N[L] respectively, then the dimensions of matrix W are N[L-1] columns and N[L] rows.

[0192] The bias for a particular layer L may also be stored in a matrix B having N[L] rows and one column.

[0193] The matrices W and B may be stored in RAM memory as vectors or arrays, or as a comma-separated set of values ​​in memory. When the artifact is stored persistently in a persistent storage device, the matrices W and B may be stored as comma-separated values ​​in a compressed and / or serialized form or other suitable persistent form.

[0194] The specific input applied to the neural network includes the value of each input neuron. The specific input can be stored as a vector. The training data includes multiple inputs, each input is called a sample in the sample set. Each sample includes the value of each input neuron. The sample can be stored as a vector of input values, and the multiple samples can be stored as a matrix, where each row in the matrix is ​​a sample.

[0195] When input is applied to a neural network, activation values ​​are generated for the hidden and output layers. For each layer, the activation values ​​can be stored in a column of a matrix A that has a row for each neuron in the layer. In a vectorized approach for training, the activation values ​​can be stored in a matrix that has a column for each sample in the training data.

[0196] Training a neural network requires storing and processing additional matrices. The optimization algorithm generates matrices of derivative values ​​used to adjust the weights W and bias B matrices. Generating derivative values ​​can use and require matrices that store intermediate values ​​generated when calculating the activation values ​​of each layer.

[0197] The number of neurons and / or edges determines the size of the matrices required to implement a neural network. The fewer the number of neurons and edges in a neural network, the smaller the matrices and the memory required to store them. In addition, a smaller number of neurons and edges reduces the amount of computation required to apply or train a neural network. Fewer neurons means fewer activation values ​​that need to be calculated and / or fewer derivatives that need to be calculated during training.

[0198] The properties of the matrix used to implement the neural network correspond to neurons and edges. A cell in the matrix W represents a specific edge from the L-1 layer to a neuron in the L layer. An activated neuron represents the activation function of that layer, including the activation function. The activated neurons in the L layer correspond to the rows of the matrix W for the weights of the edge between the L layer and the L-1 layer and the columns of the matrix W for the weights of the edge between the L layer and the L+1 layer. During the execution of the neural network, the neurons also correspond to one or more activation values ​​stored in the matrix A for that layer and generated by the activation function.

[0199] ANN is suitable for vectorization of data parallelization, which can utilize vector hardware, such as single instruction multiple data (SIMD), such as utilizing a graphics processing unit (GPU). Matrix partitioning can achieve horizontal scaling, for example, utilizing symmetric multiprocessing (SMP), such as utilizing a multi-core central processing unit (CPU) and / or multiple coprocessors (such as GPU). Feedforward calculations in ANN can occur with only one step in each neural layer. The activation values ​​in one layer are calculated based on the weighted propagation of the activation values ​​of the previous layer, so that the values ​​are calculated in turn for each subsequent layer, such as sequentially calculating the values ​​for each subsequent layer, such as utilizing the corresponding iterations of a for loop. Layering imposes the ordering of non-parallelizable calculations. Therefore, the network depth (i.e., the number of layers) can cause computational delays. Deep learning requires giving multilayer perceptrons (MLPs) multiple layers. Each layer implements data abstraction, while complex (i.e., multidimensional with several inputs) abstractions require multiple layers to implement cascade processing. Implementations of ANNs based on reusable matrices and matrix operations for feed-forward processing are readily available and parallelizable in neural network libraries such as Google's TensorFlow for Python and C++, OpenNN for C++, and Fast Artificial Neural Networks (FANN) from the University of Copenhagen. These libraries also provide model training algorithms such as backpropagation.

[0200] Back Propagation

[0201] The output of an ANN can be more or less correct. For example, an ANN that recognizes letters may mistake an I for an L because the letters have similar features. The correct output may have a specific value(s), while the actual output may have a slightly different value. The arithmetic or geometric difference between the correct output and the actual output may be measured as an error according to a loss function, such that zero represents error-free (i.e., perfectly accurate) behavior. For any edge in any layer, the difference between the correct output and the actual output is the delta value.

[0202] Backpropagation requires distributing the error backward through the layers of the ANN to all connected edges within the ANN in varying amounts. The propagation of the error results in adjustments to the edge weights, which depend on the gradient of the error on each edge. The gradient of an edge is calculated by multiplying the error delta of the edge by the activation value of the upstream neuron. When the gradient is negative, the greater the error contribution of the edge to the network, the more the edge weight should be reduced, which is negative reinforcement. When the gradient is positive, positive reinforcement requires increasing the weight of the edge whose activation will reduce the error. Edge weights are adjusted based on a percentage of the edge's gradient. The steeper the gradient, the greater the adjustment. Not all edge weights are adjusted by the same amount. As model training continues with additional input samples, the error of the ANN should decrease. Training can stop when the error stabilizes (i.e., stops decreasing) or disappears below a threshold (i.e., approaches zero). Christopher M. Bishop teaches example mathematical formulas and techniques for feed-forward multilayer perceptrons (MLPs), including matrix operations and backpropagation, in the related reference "EXACT CALCULATION OF THE HESSIAN MATRIX FOR THE MULTI-LAYER PERCEPTRON".

[0203] Model training can be supervised, or unsupervised. For supervised training, the expected (i.e., correct) output is already known for each example in the training set. The training set is configured by pre-assigning classification labels to each example (e.g., by a human expert). For example, a training set for optical character recognition may have blurred photos of individual letters, and an expert may pre-label each photo according to which letter is shown. Error calculation and back-propagation occur as explained above.

[0204] Autoencoder

[0205] Because the desired output needs to be discovered during training, more unsupervised model training is involved. Unsupervised training can be easier to adopt because no human experts are required to pre-label training examples. Therefore, unsupervised training saves manpower. The natural way to implement unsupervised training is to use an autoencoder, which is a type of ANN. The autoencoder acts as an encoder / decoder (codec) with two sets of layers. The first set of layers encodes the input example into a condensed code that needs to be learned during model training. The second set of layers decodes the condensed code to regenerate the original input example. The two sets of layers are trained together as a combined ANN. The error is defined as the difference between the original input and the input regenerated after decoding. After sufficient training, the decoder outputs the original input more or less exactly.

[0206] For each input example, the autoencoder relies on a condensed code as an intermediate format. The intermediate condensed code does not exist initially, but emerges only through model training, which may be counterintuitive. Unsupervised training can implement a vocabulary of intermediate encodings based on features and distinctions of unexpected correlations. For example, which examples and which labels are used during supervised training can depend on a human expert's understanding of the problem space that is somewhat unscientific (e.g., anecdotal) or incomplete. Unsupervised training, on the other hand, discovers a suitable intermediate vocabulary more or less entirely based on statistical trends that reliably converge to optimality with enough training due to internal feedback generated by regenerating decodings. Techniques for unsupervised training of autoencoders for anomaly detection based on reconstruction error are taught in the following non-patent literature (NPL) by Jinwon An et al.: "VARIATIONAL AUTOENCODER BASED ANOMALY DETECTION USING RECONSTRUCTION PROBABILITY", Special Lecture on IE. 2015 Dec 27;2(1):1-18.

[0207] Principal component analysis

[0208] Principal Component Analysis (PCA) provides dimensionality reduction by leveraging and organizing mathematical correlation techniques such as normalization, covariance, eigenvectors, and eigenvalues. PCA combines aspects of feature selection by eliminating redundant features. PCA can be used for prediction. PCA can be used in conjunction with other ML algorithms.

[0209] Random Forest

[0210] A random forest or random decision forest is a family of learning methods that construct a collection of randomly generated nodes and decision trees during a training phase. The different decision trees of the forest are constructed such that each is randomly restricted to only a specific subset of the feature dimensions of the dataset, such as by feature bootstrapping aggregation (bagging). Thus, as the decision trees grow, they gain accuracy without being forced to overfit the training data, as would happen if the decision trees were forced to learn all feature dimensions of the dataset. The predictions can be calculated based on the average (or other integral, such as softmax) of the predictions from the different decision trees.

[0211] Random forest hyperparameters can include: number-of-trees-in-the-forest (the number of trees in the forest), maximum-number-of-features-considered-for-splitting-a-node (the maximum number of features considered for splitting a node), number-of-levels-in-each-decision-tree (the number of levels in each decision tree), minimum-number-of-data-points-on-a-leaf-node (the minimum number of data points on a leaf node), method-for-sampling-data-points (the method for sampling data points), and so on.

[0212] In the foregoing specification, embodiments of the present invention have been described with reference to numerous specific details that may vary from implementation to implementation. Accordingly, the specification and drawings should be regarded as illustrative rather than restrictive. The sole and exclusive indicator of the scope of the present invention, and what the applicants intend as the scope of the present invention, is the literal and equivalent range of the set of claims issuing from this application, in the specific form in which such claims issue, including any subsequent amendments.

Claims

1. A method comprising: receiving a plurality of unnormalized anomaly scores; selecting a highest subset of the plurality of unnormalized anomaly scores exceeding a tail threshold; training parameters of a probability density function based on a highest subset of the plurality of unnormalized anomaly scores; generating a normalized anomaly score based on the unnormalized anomaly score and a parameter of the probability density function; The method is executed by one or more computers.

2. The method of claim 1, wherein: The method also includes configuring a cumulative density function based on parameters of the probability density function; Generating the normalized anomaly score based on the parameters of the probability density function includes applying a cumulative density function to the unnormalized anomaly score.

3. The method of claim 1, wherein: The method further comprises, for each predefined tail threshold of a plurality of predefined tail thresholds, repeating: selecting a highest subset of the plurality of unnormalized anomaly scores, The parameters of the training probability density function, and measuring a fit score for parameters of a probability density function for a top subset of the plurality of unnormalized anomaly scores; The generating the normalized anomaly score uses parameters of a probability density function of a predefined tail threshold having a highest fitting score among the plurality of predefined tail thresholds.

4. The method of claim 3, wherein measuring the fit score of the parameters of the probability density function comprises applying at least one selected from the group consisting of: a Kolmogorov-Smirnov test, an Anderson-Darling test, and a quantile-quantile (QQ) plot. 5 . The method of claim 3 , wherein the plurality of predefined tail thresholds consist of at least two selected from the group consisting of 0.9, 0.99, 0.999, and 0.9999. The method of claim 3 , wherein each of the plurality of predefined tail thresholds has a different numerical precision.

7. The method of claim 1, further comprising: Unsupervised training of anomaly scoring models without anomaly thresholds; The generating the plurality of unnormalized anomaly scores is based on an anomaly scoring model.

8. The method of claim 1, wherein the parameters of the training probability density function include maximum likelihood estimation.

9. The method of claim 1, wherein the probability density function is a generalized Pareto distribution.

10. The method of claim 1, further comprising generating an unnormalized anomaly score based on a feature vector, the feature vector comprising at least one selected from the group consisting of: a timestamp of the database statement, an identifier of a database session, a network address of a database client, an identifier of an operating system (OS) of the database client, and at least a portion of the database statement.

11. The method of claim 1, wherein: The method also includes detecting whether the unnormalized anomaly score exceeds a tail threshold; The generating of the normalized anomaly score occurs only when the unnormalized anomaly score exceeds the tail threshold.

12. One or more computer-readable non-transitory media storing instructions that, when executed by one or more processors, cause the steps of any of claims 1-11 to be performed.

Images