[Paper Review] Diversifying Database Activity Monitoring with Bandits

Hagit Grushka-Cohen, Ofer Biller+3 more|arXiv (Cornell University)|Oct 23, 2019

Data Stream Mining Techniques22 references4 citations

TL;DR

This paper proposes a bandit-based sampling strategy, C–ε–Greedy, to diversify database activity monitoring (DAM) by balancing exploration of low-risk users and exploitation of high-risk ones. By modeling sampling as a Budget-Constrained-Dynamic-MAB problem, it improves coverage and anomaly detection recall while outperforming expert-knowledge and baseline policies.

ABSTRACT

Database activity monitoring (DAM) systems are commonly used by organizations to protect the organizational data, knowledge and intellectual properties. In order to protect organizations database DAM systems have two main roles, monitoring (documenting activity) and alerting to anomalous activity. Due to high-velocity streams and operating costs, such systems are restricted to examining only a sample of the activity. Current solutions use policies, manually crafted by experts, to decide which transactions to monitor and log. This limits the diversity of the data collected. Bandit algorithms, which use reward functions as the basis for optimization while adding diversity to the recommended set, have gained increased attention in recommendation systems for improving diversity. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit (MAB) problem and present a novel algorithm, which combines expert knowledge with random exploration. We analyze the effect of diversity on coverage and downstream event detection tasks using a simulated dataset. In doing so, we find that adding diversity to the sampling using the bandit-based approach works well for this task and maximizing population coverage without decreasing the quality in terms of issuing alerts about events.

Motivation & Objective

• To address the limitation of static, expert-crafted policies in database activity monitoring (DAM), which restrict diversity and risk coverage.
• To mitigate the 'filter bubble' effect in DAM systems, where only high-risk or familiar users are monitored, leading to missed concept drifts.
• To improve downstream anomaly detection by ensuring broader user coverage through strategic sampling diversity.
• To balance exploration of low-risk users with exploitation of high-risk ones, avoiding bias in audit logs.
• To propose a novel, implementable algorithm that integrates expert knowledge with random exploration in a dynamic risk environment.

Proposed method

• Reformulates database activity sampling as a Budget-Constrained-Dynamic-Multi-Armed Bandit (BCD-MAB) problem, where each user is an arm with a time-varying risk reward.
• Proposes C–ε–Greedy, a variant of ε–Greedy that splits sampling capacity into exploration (ε) and exploitation (1–ε) at each time frame.
• Uses risk scores as the reward function, updated dynamically as user behavior evolves due to role changes or compromise.
• Applies the algorithm to simulate database activity streams, with sampling capacity constrained to a fixed number of users per time frame.
• Employs simulated datasets based on real-world user behavior patterns to evaluate coverage and anomaly detection performance.
• Integrates human expertise via initialization with SO-knowledge, avoiding cold start while enabling dynamic adaptation.

Experimental results

Research questions

• RQ1 Can a bandit-based approach improve diversity in database activity monitoring without sacrificing detection of high-risk events?
• RQ2 How does balancing exploration and exploitation affect coverage of user populations and downstream anomaly detection?
• RQ3 Does a dynamic sampling policy that adapts to changing user risk profiles outperform static expert policies?
• RQ4 What is the optimal trade-off between exploration (diversity) and exploitation (risk detection) in terms of reward and recall?
• RQ5 Can a method that combines expert knowledge with random exploration achieve better performance than purely random or oracle-based policies?

Key findings

• C–ε–Greedy with 20% exploration (ε = 0.8) outperformed the oracle-knowledge policy in collecting risky activity, achieving 20% better reward than the 50% exploration variant.
• Random sampling achieved the highest anomaly recall (88%) but the worst reward, demonstrating the cost of undirected exploration.
• The SO-knowledge policy detected only 8.5% of anomalies due to monitoring only 10% of users, highlighting the danger of static policies.
• Gibbs-by-risk sampling achieved 56% anomaly recall, significantly lower than C–ε–Greedy’s 67–83%, showing limitations in risk-proportional sampling.
• C–ε–Greedy achieved full user coverage (two samples per user) in under 250 time frames with 20% exploration, outperforming pure random and Gibbs methods.
• The algorithm was robust to poor initialization and could detect users who became high-risk after initial monitoring, unlike static policies.