Using Bandits for Effective Database Activity Monitoring

Abstract

Database activity monitoring systems aim to protect organizational data by logging users' activity to Identify and document malicious activity. High-velocity streams and operating costs, restrict these systems to examining only a sample of the activity. Current solutions use manual policies to decide which transactions to monitor. This limits the diversity of the data collected, creating a "filter bubble" over representing specific subsets of the data such as high-risk users and underrepresenting the rest of the population which may never be sampled. In recommendation systems, Bandit algorithms have recently been used to address this problem. We propose addressing the sampling for database activity monitoring problem as a recommender system. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit problem and present a novel algorithm, C--Greedy, which combines expert knowledge with random exploration. We analyze the effect of diversity on coverage and downstream event detection using simulated data. In doing so, we find that adding diversity to the sampling using the bandit-based approach works well for this task, maximizing population coverage without decreasing the quality in terms of issuing alerts about events, and outperforming policies manually crafted by experts and other sampling methods.

A framework for optimizing COVID-19 testing policy using a Multi Armed Bandit approach

“…Basing a policy solely on a ranking model would be very efficient capacity wise but would lock the decision makers in a filter bubble. This approach is based on solutions to similar problems where test capacity is limited in the realm of security [5]. Saving a major part of the testing capacity for exploration allows both informed decision making and updating the ranking model daily or weekly to maximize the efficiency.…”

“…Grushka et al [5] suggested taking a dynamic approach by adding diversity into the monitoring policy to add the ability of exploration for new risks characteristics and demographics. They showed the need to balance exploration of activities and users of low risk with exploitation of high risk scored users and activities.…”

No DBA? No Regret! Multi-Armed Bandits for Index Tuning of Analytical and HTAP Workloads With Provable Guarantees

“…Unlike its more general counterpart (RL), MABs have advantages of faster convergences, simpler implementation, and theoretical guarantees [40]. There has also been recent interest in using bandits for database tasks such as monitoring, query optimisation and join ordering [63], [64], [65].…”