Dynamic threat detection for diverse databases

Abstract

Systems and techniques for database threat detection are described. First login data for a first database that includes a first aggregation key may be received. A first counter that tracks first events associated with the first database may be determined. A first value of the first counter associated with at least the first aggregation key may be determined. A first feature value associated with the first aggregation key may be determined using the first value. An aggregated anomaly detection score may be determined by combining the first anomaly detection score and a plurality of other anomaly detection scores. A determination may be made that the first login data represents anomalous database activity for the first database by comparing the aggregated anomaly detection score to a threshold anomaly detection score. First output data indicating that the first login data represents anomalous database activity for the first database may be generated.