{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,7]],"date-time":"2026-05-07T16:12:25Z","timestamp":1778170345769,"version":"3.51.4"},"publisher-location":"New York, NY, USA","reference-count":88,"publisher":"ACM","license":[{"start":{"date-parts":[[2022,6,10]],"date-time":"2022-06-10T00:00:00Z","timestamp":1654819200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.acm.org\/publications\/policies\/copyright_policy#Background"}],"content-domain":{"domain":["dl.acm.org"],"crossmark-restriction":true},"short-container-title":[],"published-print":{"date-parts":[[2022,6,10]]},"DOI":"10.1145\/3514221.3517861","type":"proceedings-article","created":{"date-parts":[[2022,6,12]],"date-time":"2022-06-12T02:33:49Z","timestamp":1655001229000},"page":"788-802","update-policy":"https:\/\/doi.org\/10.1145\/crossmark-policy","source":"Crossref","is-referenced-by-count":15,"title":["Unsupervised Contextual Anomaly Detection for Database Systems"],"prefix":"10.1145","author":[{"given":"Sainan","family":"Li","sequence":"first","affiliation":[{"name":"Tsinghua University & BNRist, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qilei","family":"Yin","sequence":"additional","affiliation":[{"name":"Tsinghua University & BNRist, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Guoliang","family":"Li","sequence":"additional","affiliation":[{"name":"Tsinghua University & BNRist, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Qi","family":"Li","sequence":"additional","affiliation":[{"name":"Tsinghua University & BNRist, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhuotao","family":"Liu","sequence":"additional","affiliation":[{"name":"Tsinghua University & BNRist, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Jinwei","family":"Zhu","sequence":"additional","affiliation":[{"name":"Huawei, Beijing, China"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"320","published-online":{"date-parts":[[2022,6,11]]},"reference":[{"key":"e_1_3_2_1_1_1","unstructured":"2013. Snowden-Ultimate Insider Threat Missed by NSA Security. https:\/\/freebeacon.com\/national-security\/cyber-threat-snowden-insider-threat-at-nsa\/."},{"key":"e_1_3_2_1_2_1","unstructured":"2020. 17 Real Examples of Insider Threats. https:\/\/www.tessian.com\/blog\/insider-threats-types-and-real-world-examples\/."},{"key":"e_1_3_2_1_3_1","unstructured":"2020. Cost of a Data Breach Report. https:\/\/www.ibm.com\/security\/data-breach."},{"key":"e_1_3_2_1_4_1","unstructured":"2021. Insider Threats Statistics. https:\/\/techjury.net\/blog\/insider-threat-statistics\/."},{"key":"e_1_3_2_1_5_1","unstructured":"2021. Masters of Mimicry. https:\/\/www.ptsecurity.com\/ww-en\/analytics\/pt-esc-threat-intelligence\/new-apt-group-chamelgang\/."},{"key":"e_1_3_2_1_6_1","doi-asserted-by":"publisher","DOI":"10.1109\/CIACS.2015.7395571"},{"key":"e_1_3_2_1_7_1","doi-asserted-by":"publisher","DOI":"10.1145\/3167132.3167307"},{"key":"e_1_3_2_1_8_1","volume-title":"Gradient based sample selection for online continual learning. arXiv preprint arXiv:1903.08671","author":"Aljundi Rahaf","year":"2019","unstructured":"Rahaf Aljundi, Min Lin, Baptiste Goujaud, and Yoshua Bengio. 2019. Gradient based sample selection for online continual learning. arXiv preprint arXiv:1903.08671 (2019)."},{"key":"e_1_3_2_1_9_1","doi-asserted-by":"publisher","DOI":"10.1145\/2500853.2500857"},{"key":"e_1_3_2_1_10_1","volume-title":"Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Privacy","volume":"13","author":"Anati Ittai","year":"2013","unstructured":"Ittai Anati, Shay Gueron, Simon Johnson, and Vincent Scarlata. 2013. Innovative technology for CPU based attestation and sealing. In Proceedings of the 2nd International Workshop on Hardware and Architectural Support for Security and Privacy, Vol. 13. ACM New York, NY, USA, 7."},{"key":"e_1_3_2_1_11_1","doi-asserted-by":"publisher","DOI":"10.1145\/3394486.3403392"},{"key":"e_1_3_2_1_12_1","volume-title":"Proceedings of International Conference on Learning Representations .","author":"Bahdanau Dzmitry","year":"2015","unstructured":"Dzmitry Bahdanau, Kyunghyun Cho, and Yoshua Bengio. 2015. Neural machine translation by jointly learning to align and translate. In Proceedings of International Conference on Learning Representations ."},{"key":"e_1_3_2_1_13_1","volume-title":"Deep nearest neighbor anomaly detection. arXiv preprint arXiv:2002.10445","author":"Bergman Liron","year":"2020","unstructured":"Liron Bergman, Niv Cohen, and Yedid Hoshen. 2020. Deep nearest neighbor anomaly detection. arXiv preprint arXiv:2002.10445 (2020)."},{"key":"e_1_3_2_1_14_1","doi-asserted-by":"publisher","DOI":"10.1109\/CSAC.2005.33"},{"key":"e_1_3_2_1_15_1","volume-title":"Proceedings of USENIX Security Symposium","volume":"12","author":"Bhatkar Sandeep","year":"2003","unstructured":"Sandeep Bhatkar, Daniel C DuVarney, and Ron Sekar. 2003. Address Obfuscation: An Efficient Approach to Combat a Broad Range of Memory Error Exploits.. In Proceedings of USENIX Security Symposium, Vol. 12. 291--301."},{"key":"e_1_3_2_1_16_1","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2014.22"},{"key":"e_1_3_2_1_17_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-01581-6"},{"key":"e_1_3_2_1_18_1","volume-title":"Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805","author":"Devlin Jacob","year":"2018","unstructured":"Jacob Devlin, Ming-Wei Chang, Kenton Lee, and Kristina Toutanova. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805 (2018)."},{"key":"e_1_3_2_1_19_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363226"},{"key":"e_1_3_2_1_20_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2016.0103"},{"key":"e_1_3_2_1_21_1","doi-asserted-by":"publisher","DOI":"10.1145\/3133956.3134015"},{"key":"e_1_3_2_1_22_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE48307.2020.00030"},{"key":"e_1_3_2_1_23_1","doi-asserted-by":"publisher","DOI":"10.1016\/S1364-6613(99)01294-2"},{"key":"e_1_3_2_1_24_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2009.60"},{"key":"e_1_3_2_1_25_1","doi-asserted-by":"publisher","DOI":"10.1145\/2046707.2093488"},{"key":"e_1_3_2_1_26_1","doi-asserted-by":"publisher","DOI":"10.1145\/2723372.2737792"},{"key":"e_1_3_2_1_27_1","volume-title":"word2vec Explained: deriving Mikolov et al.'s negative-sampling word-embedding method. arXiv preprint arXiv:1402.3722","author":"Goldberg Yoav","year":"2014","unstructured":"Yoav Goldberg and Omer Levy. 2014. word2vec Explained: deriving Mikolov et al.'s negative-sampling word-embedding method. arXiv preprint arXiv:1402.3722 (2014)."},{"key":"e_1_3_2_1_28_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-66399-9_4"},{"key":"e_1_3_2_1_29_1","unstructured":"Xiaoyi Gu Leman Akoglu and Alessandro Rinaldo. 2019. Statistical analysis of nearest neighbor methods for anomaly detection. In Advances in Neural Information Processing Systems. 10923--10933."},{"key":"e_1_3_2_1_30_1","doi-asserted-by":"publisher","DOI":"10.1145\/3340531.3412697"},{"key":"e_1_3_2_1_31_1","doi-asserted-by":"publisher","DOI":"10.1016\/S0167-8655(03)00003-5"},{"key":"e_1_3_2_1_32_1","first-page":"10","article-title":"Using innovative instructions to create trustworthy software solutions","volume":"11","author":"Hoekstra Matthew","year":"2013","unstructured":"Matthew Hoekstra, Reshma Lal, Pradeep Pappachan, Vinay Phegade, and Juan Del Cuvillo. 2013. Using innovative instructions to create trustworthy software solutions. Hardware and Architectural Support for Security and Privacy (HASP), Vol. 11, 10.1145 (2013), 2487726--2488370.","journal-title":"Hardware and Architectural Support for Security and Privacy (HASP)"},{"key":"e_1_3_2_1_33_1","volume-title":"NIST Special Publication","volume":"800","author":"Hu Vincent C","year":"2013","unstructured":"Vincent C Hu, David Ferraiolo, Rick Kuhn, Arthur R Friedman, Alan J Lang, Margaret M Cogdell, Adam Schnitzer, Kenneth Sandlin, Robert Miller, Karen Scarfone, et al. 2013. Guide to attribute based access control (ABAC) definition and considerations (draft). NIST Special Publication, Vol. 800, 162 (2013)."},{"key":"e_1_3_2_1_34_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2015.33"},{"key":"e_1_3_2_1_35_1","doi-asserted-by":"publisher","DOI":"10.1109\/MC.2015.33"},{"key":"e_1_3_2_1_36_1","volume-title":"Proceedings of International Conference on Learning Representations (ICLR) .","author":"Hu Wenpeng","year":"2018","unstructured":"Wenpeng Hu, Zhou Lin, Bing Liu, Chongyang Tao, Zhengwei Tao, Jinwen Ma, Dongyan Zhao, and Rui Yan. 2018. Overcoming catastrophic forgetting for continual learning via model adaptation. In Proceedings of International Conference on Learning Representations (ICLR) ."},{"key":"e_1_3_2_1_37_1","volume-title":"Qi Li, Bin Liu, and Mingwei Xu.","author":"Huang Hai","year":"2021","unstructured":"Hai Huang, Jiaming Mu, Neil Zhenqiang Gong, Qi Li, Bin Liu, and Mingwei Xu. 2021. Data Poisoning Attacks to Deep Learning Based Recommender Systems. arXiv preprint arXiv:2101.02644 (2021)."},{"key":"e_1_3_2_1_38_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPDS.2010.203"},{"key":"e_1_3_2_1_39_1","doi-asserted-by":"publisher","DOI":"10.1145\/2699026.2699111"},{"key":"e_1_3_2_1_40_1","doi-asserted-by":"publisher","DOI":"10.1007\/s00778-007-0051-4"},{"key":"e_1_3_2_1_41_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2018.00035"},{"key":"e_1_3_2_1_42_1","volume-title":"Proceedings of International Conference on Risks and Security of Internet and Systems. Springer, 147--152","author":"Khan Muhammad Imran","year":"2016","unstructured":"Muhammad Imran Khan and Simon N Foley. 2016. Detecting anomalous behavior in DBMS logs. In Proceedings of International Conference on Risks and Security of Internet and Systems. Springer, 147--152."},{"key":"e_1_3_2_1_43_1","volume-title":"Proceedings of International Conference on Risks and Security of Internet and Systems. Springer, 18--28","author":"Khan Muhammad Imran","year":"2017","unstructured":"Muhammad Imran Khan, Barry O'Sullivan, and Simon N Foley. 2017. A semantic approach to frequency based anomaly detection of insider access in database management systems. In Proceedings of International Conference on Risks and Security of Internet and Systems. Springer, 18--28."},{"key":"e_1_3_2_1_44_1","doi-asserted-by":"publisher","DOI":"10.1007\/11575832_13"},{"key":"e_1_3_2_1_45_1","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2017.2773081"},{"key":"e_1_3_2_1_46_1","doi-asserted-by":"publisher","DOI":"10.1145\/2889160.2889232"},{"key":"e_1_3_2_1_47_1","doi-asserted-by":"publisher","DOI":"10.1145\/3319535.3363224"},{"key":"e_1_3_2_1_48_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2008.17"},{"key":"e_1_3_2_1_49_1","volume-title":"Learning under concept drift: A review","author":"Lu Jie","year":"2018","unstructured":"Jie Lu, Anjin Liu, Fan Dong, Feng Gu, Joao Gama, and Guangquan Zhang. 2018. Learning under concept drift: A review. IEEE Transactions on Knowledge and Data Engineering (2018), 2346--2363."},{"key":"e_1_3_2_1_50_1","volume-title":"Proceedings of the 22nd ACM International Conference on Information & Knowledge Management. 1545--1548","author":"Alvarez Alejandro Marcos","year":"2013","unstructured":"Alejandro Marcos Alvarez, Makoto Yamada, Akisato Kimura, and Tomoharu Iwata. 2013. Clustering-based anomaly detection in multi-view data. In Proceedings of the 22nd ACM International Conference on Information & Knowledge Management. 1545--1548."},{"key":"e_1_3_2_1_51_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-15512-3_20"},{"key":"e_1_3_2_1_52_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDE.2017.158"},{"key":"e_1_3_2_1_53_1","doi-asserted-by":"publisher","DOI":"10.1145\/2487726.2488368"},{"key":"e_1_3_2_1_54_1","doi-asserted-by":"publisher","DOI":"10.24963\/ijcai.2019\/658"},{"key":"e_1_3_2_1_55_1","unstructured":"Tomas Mikolov Kai Chen Greg Corrado and Jeffrey Dean. 2013. Efficient Estimation of Word Representations in Vector Space. arxiv: cs.CL\/1301.3781"},{"key":"e_1_3_2_1_56_1","doi-asserted-by":"publisher","DOI":"10.21437\/ICSLP.1998-658"},{"key":"e_1_3_2_1_57_1","volume-title":"Self-attentive classification-based anomaly detection in unstructured logs. arXiv preprint arXiv:2008.09340","author":"Nedelkoski Sasho","year":"2020","unstructured":"Sasho Nedelkoski, Jasmin Bogatinovski, Alexander Acker, Jorge Cardoso, and Odej Kao. 2020. Self-attentive classification-based anomaly detection in unstructured logs. arXiv preprint arXiv:2008.09340 (2020)."},{"key":"e_1_3_2_1_58_1","volume-title":"Sabine Schulte im Walde, and Ngoc Thang Vu","author":"Nguyen Kim Anh","year":"2016","unstructured":"Kim Anh Nguyen, Sabine Schulte im Walde, and Ngoc Thang Vu. 2016. Integrating distributional lexical contrast into word embeddings for antonym-synonym distinction. arXiv preprint arXiv:1605.07766 (2016)."},{"key":"e_1_3_2_1_59_1","doi-asserted-by":"publisher","DOI":"10.1109\/DSN.2007.103"},{"key":"e_1_3_2_1_60_1","volume-title":"Proceedings of European Conference on Computer Vision.","author":"Peri Neehar","unstructured":"Neehar Peri, Neal Gupta, W Ronny Huang, Liam Fowl, Chen Zhu, Soheil Feizi, Tom Goldstein, and John P Dickerson. [n. d.]. Deep k-nn defense against clean-label data poisoning attacks. In Proceedings of European Conference on Computer Vision."},{"key":"e_1_3_2_1_61_1","doi-asserted-by":"crossref","unstructured":"U. P. Rao and N. K. Singh. 2015. Detection of Privilege Abuse in RBAC Administered Database .Intelligent Systems in Science and Information.","DOI":"10.1007\/978-3-319-14654-6_4"},{"key":"e_1_3_2_1_62_1","volume-title":"Experience replay for continual learning. arXiv preprint arXiv:1811.11682","author":"Rolnick David","year":"2018","unstructured":"David Rolnick, Arun Ahuja, Jonathan Schwarz, Timothy P Lillicrap, and Greg Wayne. 2018. Experience replay for continual learning. arXiv preprint arXiv:1811.11682 (2018)."},{"key":"e_1_3_2_1_63_1","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1398"},{"key":"e_1_3_2_1_64_1","doi-asserted-by":"publisher","DOI":"10.1109\/JSYST.2015.2487221"},{"key":"e_1_3_2_1_65_1","doi-asserted-by":"publisher","DOI":"10.1002\/widm.1195"},{"key":"e_1_3_2_1_66_1","volume-title":"Rasteiro","author":"Santos Ricardo Jorge","year":"2012","unstructured":"Ricardo Jorge Santos, Jorge Bernardino, Marco Vieira, and Deolinda M. L. Rasteiro. 2012. Securing Data Warehouses from Web-Based Intrusions. In Proceedings of Web Information Systems Engineering (WISE)."},{"key":"e_1_3_2_1_67_1","volume-title":"Estimating the support of a high-dimensional distribution. Neural computation","author":"Sch\u00f6lkopf Bernhard","year":"2001","unstructured":"Bernhard Sch\u00f6lkopf, John C Platt, John Shawe-Taylor, Alex J Smola, and Robert C Williamson. 2001. Estimating the support of a high-dimensional distribution. Neural computation, Vol. 13, 7 (2001), 1443--1471."},{"key":"e_1_3_2_1_68_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"e_1_3_2_1_69_1","doi-asserted-by":"publisher","DOI":"10.1145\/3097983.3098177"},{"key":"e_1_3_2_1_70_1","doi-asserted-by":"publisher","DOI":"10.1145\/3243734.3243811"},{"key":"e_1_3_2_1_71_1","volume-title":"Proceedings of Ifip Wg 113 Working Conference on Data & Applications Security.","author":"Spalka A.","unstructured":"A. Spalka and J. Lehnhardt. 2005. A comprehensive approach to anomaly detection in relational databases. In Proceedings of Ifip Wg 113 Working Conference on Data & Applications Security."},{"key":"e_1_3_2_1_72_1","volume-title":"Pang Wei Koh, and Percy Liang","author":"Steinhardt Jacob","year":"2017","unstructured":"Jacob Steinhardt, Pang Wei Koh, and Percy Liang. 2017. Certified defenses for data poisoning attacks. arXiv preprint arXiv:1706.03691 (2017)."},{"key":"e_1_3_2_1_73_1","doi-asserted-by":"publisher","DOI":"10.1145\/3292500.3330672"},{"key":"e_1_3_2_1_74_1","volume-title":"Mixup-Transfomer: Dynamic Data Augmentation for NLP Tasks. arXiv preprint arXiv:2010.02394","author":"Sun Lichao","year":"2020","unstructured":"Lichao Sun, Congying Xia, Wenpeng Yin, Tingting Liang, Philip S Yu, and Lifang He. 2020. Mixup-Transfomer: Dynamic Data Augmentation for NLP Tasks. arXiv preprint arXiv:2010.02394 (2020)."},{"key":"e_1_3_2_1_75_1","doi-asserted-by":"publisher","DOI":"10.1145\/2063576.2063690"},{"key":"e_1_3_2_1_76_1","doi-asserted-by":"publisher","DOI":"10.1016\/j.cmpb.2005.11.007"},{"key":"e_1_3_2_1_77_1","volume-title":"The problem of concept drift: definitions and related work. Computer Science Department","author":"Tsymbal Alexey","year":"2004","unstructured":"Alexey Tsymbal. 2004. The problem of concept drift: definitions and related work. Computer Science Department, Trinity College Dublin (2004)."},{"key":"e_1_3_2_1_78_1","doi-asserted-by":"publisher","DOI":"10.1016\/0304-3975(92)90143-4"},{"key":"e_1_3_2_1_79_1","unstructured":"Ashish Vaswani Noam Shazeer Niki Parmar Jakob Uszkoreit Llion Jones Aidan N Gomez Lukasz Kaiser and Illia Polosukhin. 2017. Attention is all you need. In Advances in Neural Information Processing Systems. 5998--6008."},{"key":"e_1_3_2_1_80_1","doi-asserted-by":"publisher","DOI":"10.1145\/586110.586145"},{"key":"e_1_3_2_1_81_1","doi-asserted-by":"publisher","DOI":"10.3390\/s20092451"},{"key":"e_1_3_2_1_82_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-030-01234-2_1"},{"key":"e_1_3_2_1_83_1","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-642-04219-5_3"},{"key":"e_1_3_2_1_84_1","doi-asserted-by":"publisher","DOI":"10.1109\/ICDM.2009.19"},{"key":"e_1_3_2_1_85_1","doi-asserted-by":"publisher","DOI":"10.1109\/MSN.2015.40"},{"key":"e_1_3_2_1_86_1","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR42600.2020.01009"},{"key":"e_1_3_2_1_87_1","volume-title":"Proceedings of International Conference on Learning Representations.","author":"Zong Bo","year":"2018","unstructured":"Bo Zong, Qi Song, Martin Renqiang Min, Wei Cheng, Cristian Lumezanu, Daeki Cho, and Haifeng Chen. 2018. Deep autoencoding gaussian mixture model for unsupervised anomaly detection. In Proceedings of International Conference on Learning Representations."},{"key":"e_1_3_2_1_88_1","volume-title":"A reinforced generation of adversarial examples for neural machine translation. arXiv preprint arXiv:1911.03677","author":"Zou Wei","year":"2019","unstructured":"Wei Zou, Shujian Huang, Jun Xie, Xinyu Dai, and Jiajun Chen. 2019. A reinforced generation of adversarial examples for neural machine translation. arXiv preprint arXiv:1911.03677 (2019)."}],"event":{"name":"SIGMOD\/PODS '22: International Conference on Management of Data","location":"Philadelphia PA USA","acronym":"SIGMOD\/PODS '22","sponsor":["SIGMOD ACM Special Interest Group on Management of Data"]},"container-title":["Proceedings of the 2022 International Conference on Management of Data"],"original-title":[],"link":[{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3514221.3517861","content-type":"unspecified","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/dl.acm.org\/doi\/pdf\/10.1145\/3514221.3517861","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,6,17]],"date-time":"2025-06-17T19:30:36Z","timestamp":1750188636000},"score":1,"resource":{"primary":{"URL":"https:\/\/dl.acm.org\/doi\/10.1145\/3514221.3517861"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,6,10]]},"references-count":88,"alternative-id":["10.1145\/3514221.3517861","10.1145\/3514221"],"URL":"https:\/\/doi.org\/10.1145\/3514221.3517861","relation":{},"subject":[],"published":{"date-parts":[[2022,6,10]]},"assertion":[{"value":"2022-06-11","order":3,"name":"published","label":"Published","group":{"name":"publication_history","label":"Publication History"}}]}}