Abstract

Insider threats to databases in the financial sector have become a very serious and pervasive security problem. This paper proposes a framework to analyze access patterns to databases by clustering SQL queries issued to the database. Our system Ettu works by grouping queries with other similarly structured queries. The small number of intent groups that result can then be efficiently labeled by human operators. We show how our system is designed and how the components of the system work. Our preliminary results show that our system accurately models user intent.

BibTex

@inproceedings{10.1145/2872518.2888608,
author = {Kul, Gokhan and Luong, Duc and Xie, Ting and Coonan, Patrick and Chandola, Varun and Kennedy, Oliver and Upadhyaya, Shambhu},
title = {Ettu: Analyzing Query Intents in Corporate Databases},
year = {2016},
booktitle = {Proceedings of the 25th International Conference Companion on World Wide Web},
pages = {463–466},
numpages = {4},
series = {WWW '16 Companion}
}