Asaf Shabtai

In this paper, we propose a new unsupervised approach for identifying suspicious access to sensitive relational data. In the proposed method, a tree-like model encapsulates the characteristics of the result-set (i.e., data) that the user normally access within each possible context. During the detection phase, result-sets are examined against the induced model and a similarity score is derived.