Databases, serving as crucial tools for storing and managing critical information, play pivotal roles in today's information technology landscape and are simultaneously focal points for cybersecurity. However, an increasing number of anomalous attacks targeting databases have emerged, resulting in numerous incidents such as data breaches and deletions, causing significant disruptions to database security. Despite the existence of some methods for protecting databases, current detection approaches lack interpretability, making it challenging to analyze anomalous operational behaviors and provide explanations for why they are considered anomalous. In this paper, we introduce DBSFT, a database operation behavior anomaly detection and analysis method with interpretability. Initially, pretraining is conducted using the RoBERTa model, followed by fine-tuning for the tasks of anomaly detection and anomaly analysis. Unlike previous methods, this model employs a multi-task learning approach. Experimental results indicate that DBSFT outperforms the current state-of-the-art models for each task, demonstrating superior performance in both anomaly detection and analysis tasks.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DBSFT: A High-Precision Database Anomaly Detection and Analysis via Task-Tune Based LLM

  • Huazhen Zhong,
  • Jibin Wang,
  • Xuejian Wang,
  • Xin Wang,
  • Wenjie Xiao,
  • Xuehai Tang,
  • Liangjun Zang

摘要

Databases, serving as crucial tools for storing and managing critical information, play pivotal roles in today's information technology landscape and are simultaneously focal points for cybersecurity. However, an increasing number of anomalous attacks targeting databases have emerged, resulting in numerous incidents such as data breaches and deletions, causing significant disruptions to database security. Despite the existence of some methods for protecting databases, current detection approaches lack interpretability, making it challenging to analyze anomalous operational behaviors and provide explanations for why they are considered anomalous. In this paper, we introduce DBSFT, a database operation behavior anomaly detection and analysis method with interpretability. Initially, pretraining is conducted using the RoBERTa model, followed by fine-tuning for the tasks of anomaly detection and anomaly analysis. Unlike previous methods, this model employs a multi-task learning approach. Experimental results indicate that DBSFT outperforms the current state-of-the-art models for each task, demonstrating superior performance in both anomaly detection and analysis tasks.