МОДЕЛЮВАННЯ ПОВЕДІНКОВИХ РИЗИКІВ КОРИСТУВАЧІВ КОРПОРАТИВНИХ БАЗ ДАНИХ ІЗ ВИКОРИСТАННЯМ МЕТОДІВ МАШИННОГО НАВЧАННЯ

A model for anomaly detection in user behavior within corporate databases was presented, based on a hybrid LSTM-Autoencoder architecture. It is emphasized that the proposed approach integrates both structural and temporal behavioral factors, allowing effective detection of contextual and sequential deviations. For validation, real ERP-oriented data from the SALT (Sales Autocompletion Linked Tables) dataset were used, comprising more than 2.3 million records reflecting transactions, clients, and logistics processes. The data were aggregated into temporal windows of length m = 20 queries with 87 features, formalizing the dynamics of user activity. Training was conducted on a Tesla T4 GPU (16 GB) using the Adam optimizer with a learning rate of 1e−3, batch size 128, and 50 epochs, during which the loss function stabilized at MSE = 0.0023. The threshold value dynamically adapted to the current risk distribution, reducing false positives to 3.1%. The mean reconstruction error for normal windows was Lrec = 0.0017, while for anomalous windows it was 0.0079, providing more than a fourfold separation between clusters. The model achieved Precision = 0.946, Recall = 0.931, F1-score = 0.938, and AUC = 0.972, outperforming classical methods such as Isolation Forest and One-Class SVM by 7–15%. The results show that that the dynamic threshold mechanism θt enables the system to adapt its sensitivity to varying workloads, maintaining balance between accuracy and robustness. Experimental results confirm the model’s ability to distinguish between structural and behavioral anomalies, including sudden shifts in query types, actions inconsistent with user roles, and unusual geographic sources of access. Thus, the proposed method forms the basis for an intelligent real-time behavioral risk assessment system for corporate databases, capable of integration into existing DBMS environments through a middleware interface without compromising performance.