Database access anomaly detection method based on semantic vector and graph embedding

Abstract

The invention relates to the technical field of database security and anomaly detection, in particular to a database access anomaly detection method based on semantic vector and graph embedding, which is characterized by mainly comprising the following steps: preprocessing a data set, and extracting semantic units in the data set; a Word2Vec model is adopted to train the semantic unit, and a semantic vector of the SQL statement is generated; constructing a heterogeneous information graph taking a user, an operation type and a database table as nodes; establishing an undirected edge based on an entity association relationship, taking an association frequency as a weight, and taking a semantic vector as a node initial feature of the heterogeneous information graph; adopting a graph attention network GAT as a graph embedding algorithm to train the heterogeneous information graph, and generating a graph embedding feature corresponding to each database access statement; the graph embedding features are grouped according to a database table, and a sliding window is adopted to generate a corresponding time sequence; inputting the time sequence into the LSTM network, jointly optimizing graph embedding loss, time sequence modeling loss and regularization loss based on a designed total loss function to complete model training, and outputting time sequence features; and calculating the similarity between the output time sequence characteristics and the real image embedding characteristics, and judging whether the corresponding SQL operation is an abnormal operation or not according to a comparison result of the similarity and a threshold value. According to the method, SQL semantics, entity association and time sequence dependence multi-dimensional information can be fully fused, the accuracy and recall rate of anomaly detection are effectively improved, and reliable support is provided for database security protection.

Description

TECHNICAL FIELD

[0004] The application belongs to the technical field of database security and anomaly detection, and particularly relates to a database access anomaly detection method based on semantic vectors and graph embedding. BACKGROUND

[0005] With the rapid development of digital economy, the security of database as the storage carrier of enterprise core data assets directly determines the business continuity and data integrity. Structured Query Language (SQL) as the core tool for interacting with the database covers key operations such as data query, modification, deletion, etc. Normal SQL operations are the basis for business operation, but abnormal SQL operations (such as unauthorized user access to core tables, high-frequency batch deletion of data, cross-table modification not in line with business logic, etc.) may lead to data leakage, tampering or system crash, so the anomaly detection of SQL operations has become one of the core needs of database security protection.

[0006] Early technologies match and detect SQL operations through pre-set static rules. Such methods are simple to implement and fast to respond, but have significant limitations: on the one hand, the rules need to be manually written by humans, which is difficult to cover complex and diverse SQL syntax; on the other hand, they cannot adapt to business changes and are completely ineffective for "abnormal intentions under legal syntax" (such as obtaining complete sensitive data by splicing multiple SELECTs). To break through the limitations of rules, researchers introduced machine learning models such as logistic regression, support vector machine (SVM), random forest, etc., and extracted manual features such as "keyword frequency", "number of operation tables", "execution time" to make abnormality judgments. Although such methods reduce the dependence on manual rules, they have the problem of rough feature engineering, only focusing on the surface statistical features of SQL, without deeply mining the semantic intent of the statement, resulting in low accuracy of semantic-level anomaly detection. With the development of deep learning technology, natural language processing (NLP), graph neural network (GNN) and time series model have been gradually applied to SQL anomaly detection: semantic modeling: some solutions use Word2Vec, BERT and other models to convert SQL statements into semantic vectors, trying to capture the deep intent of the statement; entity association: a few solutions construct an interaction graph between users and tables, and extract associated features through DeepWalk, Node2Vec and other graph embedding algorithms; time series modeling: some solutions use LSTM, GRU and other models to analyze the time series dependence of SQL operations and identify time series anomalies such as "high-frequency operations at non-working hours". However, these methods still have some shortcomings. SQL semantic features are not fully represented, entity association relationships are not fully utilized, time series dependence and multi-source feature fusion have poor synergy, and the model has insufficient generalization ability and engineering practicality.

[0007] In summary, existing SQL anomaly detection technologies still have shortcomings in terms of semantic representation accuracy, entity association mining depth, multi-source feature synergy, and engineering practicality, and cannot meet the needs of efficient and accurate detection of SQL operation anomalies in complex business scenarios. Summary of the Invention

[0008] To address the shortcomings of existing SQL anomaly detection technologies, such as insufficient semantic feature representation, incomplete utilization of entity relationships, poor synergy in multi-source feature fusion, and insufficient model generalization ability, this invention proposes a database access anomaly detection method based on semantic vectors and graph embedding, specifically including the following steps:

[0009] S1. Perform preprocessing on the dataset to extract semantic units; train the semantic units using the Word2Vec model to generate semantic vectors for SQL statements;

[0010] S2. Construct a heterogeneous information graph with users, operation types, and database tables as nodes; establish undirected edges based on entity relationships, use association frequency as weight, and use semantic vectors as the initial features of the nodes in the heterogeneous information graph.

[0011] S3. The graph attention network (GAT) is used as the graph embedding algorithm to train the heterogeneous information graph and generate graph embedding features corresponding to each database access statement; the graph embedding features are grouped according to the database table, and the corresponding time series is generated using a sliding window.

[0012] S4. Input the time series into the LSTM network, and jointly optimize the graph embedding loss, temporal modeling loss and regularization loss based on the designed total loss function to complete the model training and output the temporal features.

[0013] S5. Calculate the similarity between the output temporal features and the real graph embedding features, and determine whether the corresponding SQL operation is an abnormal operation based on the comparison result of the similarity and the threshold.

[0014] Furthermore, the preprocessing of the dataset containing SQL statements specifically includes: removing records with missing SQL statements; performing word segmentation on the SQL statements; removing stop words with no semantic distinguishability, such as "FROM"; unifying SQL statement keywords, standardizing parameter formats, and filtering redundant characters; and finally extracting the user, operation type, and operation object from the SQL statements as the semantic units.

[0015] Furthermore, the training of semantic units in the Word2Vec model specifically includes: using the Skip-gram model as the basic model of Word2Vec; constructing the preprocessed semantic units into a training corpus, setting the semantic vector dimension to 128 dimensions; using the negative sampling method to optimize the model training process; and generating a fixed-dimensional semantic vector for the SQL statement by weighted summation of the vectors corresponding to all semantic units in a single SQL statement.

[0016] Furthermore, constructing a heterogeneous information graph with users, operation types, and database tables as nodes specifically includes: treating users, operation types, and database tables as entity nodes of the graph; establishing undirected edges between user nodes and operation type nodes to represent users performing corresponding operations, and establishing undirected edges between operation type nodes and corresponding database table nodes to represent operations accessing database tables; to ensure that the node's own characteristics are preserved during the propagation of graph neural network information, adding a self-loop edge pointing to itself to each node, and adding an association frequency attribute to each edge as a supplement to the edge features of GAT training; the association frequency is the number of interactions between corresponding entities within a fixed period. The initial features of the nodes are the mean aggregation results of the corresponding operation type keywords and database table name semantic vectors.

[0017] Furthermore, the training of the heterogeneous information graph using GAT as a graph embedding algorithm specifically includes: setting two graph attention layers, each containing four attention heads; calculating attention coefficients using a LeakyReLU activation function with a negative slope of 0.2; fusing multi-head features in the first graph attention layer using vector concatenation; fusing multi-head features in the second layer using average pooling; and calculating the local loss of GAT using cross-entropy loss.

[0018] Furthermore, the process of grouping by table and generating time-series feature sequences using a sliding window algorithm specifically includes: traversing all graph embedding features, dividing graph embedding features belonging to the same database table into a group to ensure that features in the same group correspond to access operations of only a single database table; sorting by timestamp from smallest to largest to ensure consistency of time-series order; and setting appropriate window size, step size, and other parameters to ensure reasonable overlap between windows.

[0019] Furthermore, the input to the LSTM network specifically includes: configuring the network structure and regularization design: adding a Dropout layer after each hidden layer with a dropout rate of 0.2, and adding a LayerNorm layer after the input layer to suppress model overfitting through double regularization;

[0020] Furthermore, the designed total loss function is a multi-objective weighted loss function, comprising three parts: GAT graph embedding loss, LSTM temporal modeling loss, and regularization loss. The GAT graph embedding loss uses cross-entropy loss, the temporal modeling loss uses mean squared error loss, and the regularization loss uses L2 regularization to constrain all learnable parameters of the model. The weight hyperparameters of the three types of losses all range from 0.01 to 0.5. The AdamW optimizer is used for model training, and an early stopping strategy is adopted where the total loss does not decrease for 6 consecutive rounds to avoid overtraining of the model.

[0021] Furthermore, the calculation of similarity and the setting of anomaly detection threshold specifically include: the similarity calculation uses cosine similarity, and the anomaly detection threshold uses adaptive quantiles, taking the similarity value corresponding to the 95th quantile; if the cosine similarity is lower than the set threshold, it is determined to be an abnormal database access operation.

[0022] The beneficial effects of this invention are as follows: improved semantic representation accuracy: through preprocessing and weighted semantic vector aggregation, the accuracy of semantic vector representation is improved, which can effectively identify semantic-level anomalies; enhanced entity association discriminability: GAT's attention mechanism can adaptively distinguish between high-frequency normal associations and low-frequency abnormal associations, and the node type classification auxiliary task improves the distinguishability of heterogeneous node features, which can accurately identify association-level anomalies such as "unauthorized users operating core tables"; combined with LSTM temporal modeling, it can effectively identify compound anomalies such as "normal users operating abnormal tables at abnormal times". Attached Figure Description

[0023] To make the objectives, technical solutions, and advantages of the present invention clearer, the preferred embodiments of the present invention will be described in detail below with reference to the accompanying drawings, wherein:

[0024] Figure 1 This is a diagram of the architecture of the present invention;

[0025] Figure 2 Flowchart of the data preprocessing and semantic coding module;

[0026] Figure 3 Flowchart of graph construction and graph embedding module;

[0027] Figure 4 This is a flowchart of the timing capture and anomaly detection module. Detailed Implementation

[0028] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0029] 1. Formal definition of the problem

[0030] To clearly illustrate the technical logic of this invention, the problem of anomaly detection in time-series SQL operations based on semantic vectors and graph embedding is first formally defined:

[0031] User set: Let the user set be U = {u1, u2, ... u} M}, M is the total number of users; where u i ∈U represents the i-th database user. Database table set: Let the database table set be T = {t1, t2, ..., t}. N}, where N is the total number of items in the table; and t i ∈T represents the i-th database table. It's important to note that the same table name in different databases represents different tables. SQL operation type set: Let the operation type set be O = {o1, o2, ... o...} p}, where P is the total number of operation types; where o i ∈O represents the i-th type of SQL operation.

[0032] Graph structure definition:

[0033] The heterogeneous information graph constructed in this invention is denoted as G = (V, E, A), where:

[0034] The node set, V = U∪O∪T, contains three types of heterogeneous nodes: users, operation types, and database tables.

[0035] Edge set: E = E U-O ∪E O-T E U-O ={(u,o)|u∈U,o∈O,u executes o} is a user-operation type edge, E O-T ={(o,t)|o∈O,t∈T,o acts on t}, which is an operation type - table edge;

[0036] Edge attribute matrix: A∈R |V|×|V| Let A be an adjacency matrix. ij This represents node v. i, With v j, The frequency of association between them, when there is no association A ij =0.

[0037] Core task definition:

[0038] The core task of this invention is to construct an anomaly detection model F, which takes a single SQL operation s with a timestamp as input. q Output its anomaly determination result. With confidence level q .Right now:

[0039]

[0040] in, The model needs to meet the requirements of "low false positive rate for normal operations and high recall rate for abnormal operations".

[0041] 2. Detailed Implementation of the Model

[0042] The overall architecture of the model proposed in this invention (denoted as SQL-REGAN, SQL Representation with GraphAttention and LSTM) is as follows: Figure 1 As shown (attached) Figure 1 (SQL-REGAN model architecture diagram). The following details the specific implementation logic and parameter configuration of each module.

[0043] 2.1 Data Preprocessing and Semantic Coding Module

[0044] This module is responsible for converting SQL statement text into precise semantic vectors, such as... Figure 2 As shown, the specific steps are as follows:

[0045] SQL text preprocessing, taking a single SQL statement "UPDATE user_info SET balance=1000WHERE id=123" as an example, is performed by word segmentation according to SQL syntax rules, resulting in ["UPDATE","user_info","SET","balance","=","1000","WHERE","id","=","123"]; Stop word filtering: removes the preset stop word list (["SET",

[0046] The syntax is as follows: `"WHERE", "=", "AND", "OR"]` removes numeric parameters. Syntax standardization: operation types are uniformly uppercase, and table aliases are restored.

[0047] Word2Vec semantic vector training. Corpus construction: SQL operation logs were collected, and all semantic units were extracted to construct a corpus with a total of approximately 500,000 semantic units. Model configuration: The Skip-gram model was selected (because low-frequency semantic units such as DELETE account for a relatively small proportion), the vector dimension was set to 128, the negative sampling number was set to 8, the learning rate was linearly decayed from 0.025 to 0.001, and the training epochs were 150.

[0048] Vector aggregation: Weighted summation is performed on the semantic vectors from the examples above, ultimately generating a semantic vector s. q ∈

[0049] R 128Simultaneously, independent semantic vectors corresponding to storage operation type keywords and database table names are constructed to build a semantic vector library.

[0050] 2.2 Graph Construction and Graph Embedding Module

[0051] The process of constructing heterogeneous information graphs and generating graph embedding features using GAT is as follows: Figure 3 As shown, the specific implementation is as follows:

[0052] Heterogeneous Infographic Construction: Based on cleaned enterprise SQL logs, construct graph G = (V, E, A):

[0053] Node and edge initialization. User node U = {u1, u2, ..., u} n}, Operation type node O = {o 1, o 2, …o p}, database table node T = {t 1, t 2, …t m In this example, n=50, p=6, m=5, and the frequency of associations within a fixed time period is counted, such as E. U-O (u1,o) 1, The association frequency is 30, E O-T (o1,t) 1, The association frequency is 120, and the corresponding position in adjacency matrix A is assigned the value of the adjacency matrix A with that frequency. ij Assign the frequency value to the corresponding position, and add self-loop edges to all nodes. ii =1, ensuring node-specific features are preserved. The semantic vectors of all operations are categorized by entity type, forming three subsets of historical operations:

[0054] User subset: S u ={s q |s q The executing user is u}, which contains the semantic vectors of all historical operations of user u;

[0055] Operation type subset: S o ={s o |s o The table contains semantic vectors of all historical operations of type o; Subset: S t ={s t |s t The operation object is t}, which contains the semantic vector of all historical operations performed on table t.

[0056] Initial feature assignment for nodes: The initial features of all three types of nodes are calculated using the "mean of historical operation semantic vectors". The initial feature h of user node u is... u The formula is as follows:

[0057]

[0058] Where |S u | represents the total number of historical operations for user u. For example, if user u1 has 120 historical operations, then |S u | = 120, which reflects users' long-term operating habits through mean aggregation.

[0059] The initial feature h of operation type node o o The formula is as follows:

[0060]

[0061] Where |S o | represents the total number of historical operations for operation type o (e.g., if the UPDATE operation has 5000 historical records, then |S o (|=5000), the mean aggregation reflects the general semantic features of this type of operation.

[0062] Initial characteristics h of database table node t t The formula is as follows:

[0063]

[0064] Where |S t | represents the total number of historical operations performed on table t (e.g., if the user_info table has 3200 historical accesses, then |S t |=3200), the typical access semantics of the table are reflected by the mean aggregation.

[0065] GAT Model Training: Network Parameter Configuration: 2-layer graph attention layer, 4 attention heads per layer; input layer is the initial node embedding, output layer dimension is consistent with the semantic vector, attention calculation is performed by user node u and its neighboring operation node o. 1, For example, calculate the attention coefficient of the i-th layer. Negative slope 0.2. W is the attention vector. i Let be a linear transformation matrix. For the characteristics of user nodes, The features of the corresponding neighbor operation nodes are represented by softmax. The neighbor coefficients are normalized using softmax to obtain... Then, neighbor features are aggregated according to weights to obtain the output features of the i-th layer of node u1. Average pooling is used when i=2. Node type classification is used as an auxiliary task (classifying nodes into three categories: "user," "operation type," and "database table"). Cross-entropy loss is used to calculate the local GAT loss, minimizing the difference between the predicted and true node types. During training, this loss decreases from the initial 1.2 to below 0.25 to ensure effective node type differentiation. Operation-level graph embedding generation: For a single access operation, its corresponding "user node embedding, operation type node embedding, and table node embedding" are extracted and weighted and summed according to edge association frequency to generate the operation-level graph embedding g. q .

[0066] 2.3 Timing Capture and Anomaly Detection Module

[0067] The process of capturing time-series dependencies and performing anomaly detection is as follows: Figure 4 As shown, the specific implementation is as follows:

[0068] Graph embedding g q Perform Z-score normalization and traverse all operation-level graph embeddings g. q Using the operation object as the group identifier, g operations applied to the same table will be grouped together. q Divide into groups (e.g., the "user_info" table group contains all operations on that table). q This ensures that features within the same group correspond to access patterns in only a single table, avoiding confusion regarding access patterns across different tables. For each group, g... q Sort the data according to the timestamps of the corresponding operations from smallest to largest to ensure the continuity of the temporal logic (e.g., operations on 2024-05-20 should be listed before those on 2024-05-21). Set the sliding window size to 15 and the step size to 5 (the window sliding interval ensures that adjacent windows retain overlap and captures continuous temporal dependencies); starting from the beginning of the grouped data, continuously slide the window with a fixed step size, capturing 15 bytes each time. q Composition of temporal subsequence f i , i represents the i-th time series subsequence; data completion: when the window slides to the end of the group, if g in the window q The quantity is less than 15 (e.g., the last window contains only 10g). q If the remaining 5 positions are filled with zero vectors, then the length of all time series sequences is made uniform; finally, the time series feature sequence set F = [f1, f2...f...] is generated for each table. n Each sequence corresponds to a local access mode with a time window.

[0069] The LSTM network configuration structure includes two hidden layers, each with 256 hidden nodes (adapting to 128-dimensional graph embedding input); the input layer has a dimension of 128, and the output layer has a dimension of 128 (consistent with the graph embedding dimension, facilitating subsequent similarity calculation); a Dropout layer is added after each hidden layer, with a dropout rate of 0.2 (randomly dropping 20% ​​of neurons to suppress overfitting); a LayerNorm layer is added after the input layer (normalizing the input features to a mean of 0 and a variance of 1, improving model stability); the temporal feature sequences of each table are input into the LSTM, and the temporal dependencies are captured through gating mechanisms (input gate, forget gate, output gate), outputting the temporal modeling features at each time step. The hidden layer calculation is as follows: Assume the LSTM contains two hidden layers, each with H = 256 hidden nodes, and the hidden state of the l-th layer at time k... for:

[0070]

[0071] Where i, f, c, and o are the input gate, forget gate, cell state, and output gate, respectively; W, U, and b are the gating parameters; σ is the Sigmoid activation function; and ⊙ is the element-wise product. The hidden state at the last moment of the second layer is taken as the temporal modeling feature.

[0072] Total loss function: A multi-objective weighted loss function is adopted, which includes three parts: GAT graph embedding loss, LSTM temporal modeling loss, and regularization loss. The formula is: L total =λ1L grp +λ2L seq +λ3L reg ,L grp The cross-entropy loss for node classification in GAT is used to optimize GAT's ability to distinguish heterogeneous nodes. The formula is as follows:

[0073]

[0074] Where |V| is the total number of nodes, y x,c For the actual type of the node (c=1 for user, c=2 for operation type, c=3 for table), p x,c To predict the probability. L seq To model the mean squared error loss for time series, and minimize the difference between the time series modeled features and the true graph embedding features, L seq For time series modeling loss, mean squared error loss is used, and the formula is as follows:

[0075]

[0076] Where Q is the total number of operations, ||·||2 is the L2 norm, and O q It is the hidden state at the last moment of the second layer, g qIs the graph embedding corresponding to the current operation.

[0077] L reg Adopt L2 regularization to constrain the parameter norm and avoid overfitting. The formula is as follows:

[0078]

[0079] Where W GAT Is the set of linear transformation matrices of GAT, and W LSTM Is the set of gating parameters of LSTM.

[0080] λ1, λ2, and λ3 are adjustable weight parameters. In this example, λ1 = 0.5, λ2 = 0.5, and λ3 = 0.001. The optimizer uses the Adam optimizer with weight decay, the initial learning rate is set to 0.001, and the weight decay coefficient is set to 10 -5 . Adopt the "early stopping strategy". If the total loss of the validation set does not decrease for 6 consecutive rounds, stop training, save the optimal model parameters, and avoid the decline of generalization ability caused by overtraining.

[0081] After the model training is completed, perform anomaly determination on the newly input SQL operation:

[0082] For the new database operation log S to be detected new , extract semantic units, generate semantic vectors, input them into the GAT model to obtain the corresponding real graph embedding feature g true , combine with a sliding window to generate the current time series, and then input it into the trained LSTM to obtain the predicted graph embedding g pre , calculate its cosine similarity with the real graph embedding g true .

[0083]

[0084] In the set of normal operation similarities in the training set, take the 95% quantile to determine the anomaly threshold T. If sim(g pre , g true ) < T, it is determined as an abnormal operation and the confidence level is output. The abnormal confidence level conf q The calculation formula is as follows:

[0085]

[0086] min(sim normal ) is the minimum similarity of normal operations in the training set. The larger conf q , the more credible the abnormal operation is. For example, in this example, T = 0.7, sim(g pre , g true ) is calculated to be 0.63, and sim(g pre , gtrue ) If <T, then it is determined that the operation is an abnormal mode and the corresponding confidence level is output.

[0087] Although the embodiments of the present invention have been shown and described, those of ordinary skill in the art can understand that various changes, modifications, substitutions, and variations can be made to these embodiments without departing from the principles and spirit of the present invention. The scope of the present invention is defined by the appended claims and their equivalents.

Claims

1. A database access anomaly detection method based on semantic vector and graph embedding, characterized in that, The method comprises the following steps: S1, performing preprocessing on a data set to extract semantic units therein; training the semantic units by using a Word2Vec model to generate semantic vectors of SQL statements; S2, constructing a heterogeneous information graph with users, operation types, and database tables as nodes; Based on the entity association relationship, a non-directional edge is established, and the association frequency is used as the weight, and the semantic vector is used as the initial feature of the node of the heterogeneous information graph; S3, using a graph attention network GAT as a graph embedding algorithm to train the heterogeneous information graph to generate a graph embedding feature corresponding to each database access statement; grouping the graph embedding features according to database tables, and using a sliding window to generate a corresponding time sequence; S4, inputting the time sequence into an LSTM network, and jointly optimizing the graph embedding loss, the time sequence modeling loss, and the regularization loss based on a designed total loss function to complete model training, and outputting a time sequence feature; S5, calculating the similarity between the output time sequence feature and the real graph embedding feature, and determining whether the corresponding SQL operation is an abnormal operation according to the comparison result of the similarity and a threshold. 2.The database access anomaly detection method based on semantic vector and graph embedding according to claim 1, characterized in that The preprocessing of the data set containing SQL statements specifically comprises: removing records with missing SQL statements, performing word segmentation processing on the SQL statements, and removing stop words such as "FROM" with no semantic differentiation; unifying SQL statement keywords, standardizing parameter formats, and filtering redundant characters; and finally extracting the operation user, operation type, and operation object in the SQL statement as the semantic unit. 3.The database access anomaly detection method based on semantic vector and graph embedding according to claim 2, characterized in that The Word2Vec model specifically comprises: using a Skip-gram model as the basic model of Word2Vec; constructing the semantic units obtained by preprocessing into a training corpus, and setting the dimension of the semantic vector to 128; using a negative sampling method to optimize the model training process; and generating a fixed-dimension semantic vector of a single SQL statement by weighted summation of vectors corresponding to all semantic units in the SQL statement. 4.The database access anomaly detection method based on semantic vector and graph embedding according to claim 1, characterized in that, The construction of the heterogeneous information graph with users, operation types, and database tables as nodes specifically comprises: taking the users, operation types, and database tables as entity nodes of the graph respectively; establishing a non-directional edge between the user nodes and the operation type nodes to represent that the user performs the corresponding operation, and establishing a non-directional edge between the operation type node and the corresponding database table node to represent that the operation accesses the database table; adding a self-loop edge pointing to itself to each node to ensure that the node retains its own features during information propagation of the graph neural network, and adding an association frequency attribute to each edge as a supplement to the edge features of GAT training; and the association frequency is the number of interactions between the corresponding entities within a fixed period. The initial feature of the node is the mean aggregation result of the semantic vectors of the corresponding operation type keywords and database table names.

5. The method of claim 1, wherein, The training of the heterogeneous information graph by using the GAT as the graph embedding algorithm specifically comprises: setting a 2-layer graph attention layer, each layer containing 4 attention heads; calculating the attention coefficient by using a LeakyReLU activation function with a negative slope of 0.2, the first layer of the graph attention layer adopting a vector splicing manner to fuse multi-head features, the second layer adopting an average pooling manner to fuse multi-head features, and a cross-entropy loss being used to calculate the local loss of the GAT.

6. The method of claim 1, wherein, The grouping according to tables and generation of the time sequence feature sequence by using the sliding window algorithm specifically comprises: traversing all the graph embedding features, dividing the graph embedding features belonging to the same database table into a group, ensuring that the features in the same group only correspond to the access operation of a single database table; sorting according to the timestamps in ascending order to ensure the consistency of the time sequence order, and setting appropriate window size, step and other parameters to ensure a reasonable overlap degree between the windows.

7. The method of claim 6, wherein the method further comprises: The input LSTM network specifically comprises: configuration of the network structure and regularization design: adding a Dropout layer after each hidden layer with a dropout rate of 0.2, and adding a LayerNorm layer after the input layer to inhibit model overfitting by double regularization.

8. The method of claim 1, wherein, The designed total loss function is a multi-objective weighted loss function, including three parts of a GAT graph embedding loss, an LSTM time sequence modeling loss and a regularization loss, the GAT graph embedding loss adopts a cross-entropy loss, the time sequence modeling loss adopts a mean square error loss, and the regularization loss adopts an L2 regularization for constraining all learnable parameters of the model; the weight hyperparameter of the three types of losses is in a range of 0.01-0.5, the optimization mode adopts an AdamW optimizer for model training, the early stopping strategy of total loss not decreasing for 6 consecutive rounds is adopted to avoid overtraining of the model.

9. The method of claim 1, wherein, The calculation of the similarity and setting of the abnormal judgment threshold specifically comprise: the similarity calculation adopts a cosine similarity, and the abnormal judgment threshold adopts a similarity value corresponding to a 95% quantile of an adaptive quantile; if the cosine similarity is lower than the set threshold, the database access operation is determined to be abnormal.

Images