The invention relates to the technical field of
database security and
anomaly detection, in particular to a
database access
anomaly detection method based on
semantic vector and
graph embedding, which is characterized by mainly comprising the following steps: preprocessing a
data set, and extracting semantic units in the
data set; a Word2Vec model is adopted to
train the semantic unit, and a
semantic vector of the
SQL statement is generated; constructing a
heterogeneous information graph taking a user, an operation type and a
database table as nodes; establishing an undirected
edge based on an entity association relationship, taking an association frequency as a weight, and taking a
semantic vector as a node initial feature of the
heterogeneous information graph; adopting a graph
attention network GAT as a
graph embedding algorithm to
train the
heterogeneous information graph, and generating a
graph embedding feature corresponding to each
database access statement; the graph embedding features are grouped according to a database table, and a sliding window is adopted to generate a corresponding
time sequence; inputting the
time sequence into the LSTM network, jointly optimizing graph embedding loss,
time sequence modeling loss and regularization loss based on a designed total
loss function to complete model training, and outputting time sequence features; and calculating the similarity between the output time sequence characteristics and the
real image embedding characteristics, and judging whether the corresponding
SQL operation is an abnormal operation or not according to a comparison result of the similarity and a threshold value. According to the method,
SQL semantics, entity association and time sequence dependence multi-dimensional information can be fully fused, the accuracy and
recall rate of
anomaly detection are effectively improved, and reliable support is provided for
database security protection.