ROBUST ADAPTIVE METHOD FOR DETECTING ANOMALOUS TRANSACTIONS IN DATABASES OF IOT SYSTEMS

Abstract

This paper addresses anomaly detection directly in the audit log of a database management system that stores telemetry, commands, and service events generated by Internet of Things devices. The proposed robust adaptive method builds a normal-behavior profile for an individual device, gateway, database account, or application service from aggregated characteristics of SQL queries and transactions. An integral anomaly score is calculated using a regularized robust Mahalanobis distance whose location and covariance parameters are estimated by the Minimum Covariance Determinant method. The decision threshold is calibrated from the tail of the score distribution with a Peaks Over Threshold model and a generalized Pareto distribution, while weak persistent deviations are accumulated by a CUSUM procedure. The experimental stand includes a deterministic audit-log generator, a relational repository of aggregated windows, a detection module, and a metric-calculation module. A reproducible synthetic dataset contains 60 subjects and 28,800 five-minute windows, including five types of anomalous database activity. The complete method achieved a precision of 86.48%, a recall of 72.32%, an F1-score of 78.77%, and a false-alarm rate of 0.55%. For 16 slow data-exfiltration episodes, event-level recall was 81.25%, with a median detection delay of six windows. The median time required to build 60 profiles was 1.10 s; after feature aggregation, batch scoring of 14,400 windows took 19.90 ms, and the 95th percentile of streaming latency for one window was 23.3 μs. The reported timing covers the analytical detector and does not represent the overhead of native auditing in a production DBMS.