Intrusion Detection in Database Management System Using Machine Learning

Abstract

As databases become increasingly central to modern information systems, protecting them from unauthorized access and malicious transactions has become a critical research priority. Traditional signature-based intrusion detection systems (IDS) are often ineffective in discovering novel or stealthy attacks due to their reliance on predefined patterns. To address this limitation, this study proposes an anomaly-based database intrusion detection framework that integrates PrefixSpan sequential pattern mining with adaptive binary feature engineering specifically designed for database transaction semantics. The novel contribution lies in the systematic integration of optimal pattern-mining parameters (support ratio = 0.05, pattern length [2–4]) with an OCSVM-RBF kernel transformation that effectively handles discrete binary feature spaces, addressing the fundamental challenge of learning solely from normal data in transactional contexts. The framework demonstrates robustness under realistic noise conditions (20% transaction-level corruption) and provides a comprehensive algorithm–feature-space compatibility analysis, revealing why kernel methods succeed while covariance-based approaches fail on sparse binary patterns. Experimental results show that OCSVM with the RBF kernel achieves a 98% F1-score and 95.15% AUPRC, outperforming Isolation Forest, Local Outlier Factor, Elliptic Envelope, and Probabilistic Neural Network by significant margins. These findings establish generalizable principles for sequential-pattern-based anomaly detection that extend beyond database security to any domain requiring discrete, sparse, high-dimensional feature representations.