基于K-means和naive Bayes的数据库用户行为异常检测研究  

Research of database user behavior anomaly detection based on K-means and naive Bayes

作　　者：王旭仁[1,2] 冯安然 何发镁 马慧珍 杨杰[1,2] Wang Xuren;Feng Anran;He Famei;Ma Huizhen;Yang Jie(College of Information Engineering,Capital Normal University,Beijing 100048,China;Key Laboratory of Network Assessment Technology,Institute of Information Engineering,Chinese Academy of Sciences,Beijing 100093,China;Library,Beijing Institute of Technology,Beijing 100081,China)

机构地区：[1]首都师范大学信息工程学院,北京100048 [2]中国科学院信息工程研究所中国科学院网络测评技术重点实验室,北京100093 [3]北京理工大学图书馆,北京100081

出　　处：《计算机应用研究》2020年第4期1128-1131,共4页Application Research of Computers

基　　金：国家自然科学基金资助项目(61373161);中国科学院信息工程研究所中国科学院网络测评技术重点实验室2018开放课题。

摘　　要：针对数据库用户行为异常导致数据库泄露问题,提出了一种基于K-means和naive Bayes算法的数据库用户异常检测方法。首先,利用数据库历史审计日志中用户的查询语句与查询结果,采用K-means聚类方法得到用户的分组;然后,使用naive Bayes分类算法构造用户异常检测模型。与单独使用naive Bayes分类法构造的模型相比,在数据预处理时其精简了用户行为轮廓的表示方法,降低了计算冗余,减少了81%的训练时间;利用K-means聚类方法得到用户组别,使检测的精确率提高了7.06%,F 1值提高了3.33%。实验证明,所提方法大幅降低了训练时间,取得了良好的检测效果。Aiming at database leakage caused by abnormal database user behavior,this paper proposed a database user ano-maly detection method based on K-means and naive Bayes algorithm.Firstly,the K-means clustering method obtained users’grouping based on the user’s query statements and query results in the database historical audit logs;then,the naive Bayes classification algorithm constructed the user anomaly detection model.Compared with the model constructed by naive Bayes classification alone,the simplified representation of user behavior profile reduces computational redundancy and reduces trai-ning time by 81%.Applying K-means clustering method to obtaining users’grouping improves the detection accuracy by 7.06% and the F1 value by 3.33%.Experiments show that the proposed method greatly reduces the training time and achieves better detection results.

关 键 词：数据库 用户行为 异常检测 K-MEANS聚类 NAIVE Bayes分类算法 

分 类 号：TP393.08[自动化与计算机技术—计算机应用技术]