Diversifying Database Activity Monitoring with Bandits
Hagit Grushka-Cohen, Ofer Biller, Oded Sofer, Lior Rokach, Bracha, Shapira

TL;DR
This paper introduces a novel bandit-based sampling algorithm for database activity monitoring that enhances diversity and coverage without compromising alert quality, addressing limitations of manual policy-based sampling.
Contribution
It redefines the data sampling problem as a multi-armed bandit problem and presents a new algorithm combining expert knowledge with random exploration.
Findings
Adding diversity improves coverage of database activity
Bandit-based sampling maintains alert quality
Enhanced diversity aids downstream event detection
Abstract
Database activity monitoring (DAM) systems are commonly used by organizations to protect the organizational data, knowledge and intellectual properties. In order to protect organizations database DAM systems have two main roles, monitoring (documenting activity) and alerting to anomalous activity. Due to high-velocity streams and operating costs, such systems are restricted to examining only a sample of the activity. Current solutions use policies, manually crafted by experts, to decide which transactions to monitor and log. This limits the diversity of the data collected. Bandit algorithms, which use reward functions as the basis for optimization while adding diversity to the recommended set, have gained increased attention in recommendation systems for improving diversity. In this work, we redefine the data sampling problem as a special case of the multi-armed bandit (MAB) problem…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsData Stream Mining Techniques · Advanced Bandit Algorithms Research · Mobile Crowdsensing and Crowdsourcing
