Insider attack detection in database with deep metric neural network with Monte Carlo sampling

Abstract

Role-based database management systems are most widely used for information storage and analysis but are known as vulnerable to insider attacks. The core of intrusion detection lies in an adaptive system, where an insider attack can be judged if it is different from the predicted role by performing classification on the user's queries accessing the database and comparing it with the authorized role. In order to handle the high similarity of user queries for misclassified roles, this paper proposes a deep metric neural network with strategic sampling algorithm that properly extracts salient features and directly learns a quantitative measure of similarity. A strategic sampling method of heuristically generating and learning training pairs through Monte Carlo search is proposed to select a training pair that can represent the entire dataset. With the TPC-E-based benchmark data trained with 11,000 queries for 11 roles, the proposed model produces the classification accuracy of 95.41%, which is the highest compared with the previous models. The results are verified through comparison of quantitative and qualitative evaluations, and the feature space modelled in the neural network is analysed by t-SNE algorithm.