<![CDATA[This study proposes a behavior-based framework for detecting anomalous activity in MariaDB/MySQL databases using unsupervised machine learning. Database activity was extracted from ROW-format binary logs using the pymysqlreplication library, then transformed through One-Hot Encoding and one-minute temporal aggregation into a 23-feature representation covering 82 active time slots. Isolation Forest was implemented with PyCaret using a contamination value of 0.08. The model achieved a ROC AUC of 0.9679 and 100% recall, detecting all four anomalous intervals with three false positives among 78 normal observations. Feature analysis identified transaction payload size as the strongest anomaly indicator.A controlled resampling experiment reduced anomaly prevalence from 4.9% to 0.07% while preserving the original empirical characteristics. Under this condition, precision fell to 0.87%, whereas recall remained at 100% and ROC AUC reached 0.9759. Recurring benign structural events, particularly schema initialization, could receive higher anomaly scores than genuine transaction spikes under extreme class imbalance. These findings show that the framework is effective for short-window detection but requires adaptive contamination tuning, dynamic thresholding, or explicit handling of recurring benign events for long-term deployment. An interactive Streamlit dashboard was also developed for operational monitoring.]]>
Copyrights © 2026
