Using Bandits for Effective Database Activity Monitoring
| Autor: | Hagit Grushka-Cohen, Oded Sofer, Lior Rokach, Bracha Shapira, Ofer Biller |
|---|---|
| Rok vydání: | 2020 |
| Předmět: |
021110 strategic
defence & security studies education.field_of_study Database activity monitoring Computer science Event (computing) Population 0211 other engineering and technologies Sampling (statistics) Sample (statistics) 02 engineering and technology Recommender system computer.software_genre Multi-armed bandit Task (project management) Data mining education computer |
| Zdroj: | Advances in Knowledge Discovery and Data Mining ISBN: 9783030474355 PAKDD (2) |
| Popis: | Database activity monitoring systems aim to protect organizational data by logging users’ activity to Identify and document malicious activity. High-velocity streams and operating costs, restrict these systems to examining only a sample of the activity. Current solutions use manual policies to decide which transactions to monitor. This limits the diversity of the data collected, creating a “filter bubble” over representing specific subsets of the data such as high-risk users and under-representing the rest of the population which may never be sampled. In recommendation systems, Bandit algorithms have recently been used to address this problem. We propose addressing the sampling for database activity monitoring problem as a recommender system. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit problem and present a novel algorithm, C–\(\epsilon \)–Greedy, which combines expert knowledge with random exploration. We analyze the effect of diversity on coverage and downstream event detection using simulated data. In doing so, we find that adding diversity to the sampling using the bandit-based approach works well for this task, maximizing population coverage without decreasing the quality in terms of issuing alerts about events, and outperforming policies manually crafted by experts and other sampling methods. |
| Databáze: | OpenAIRE |
| Externí odkaz: |
|