Intent‐Centric Unsupervised Anomaly Detection for SQL Logs in Integrated Power Grid Business Databases

ABSTRACT

In modern power grid infrastructures, multiple business applications—such as asset management, metering and dispatch—operate on a unified backend database. While this integration streamlines data sharing, it also introduces new security challenges: each application is expected to exhibit a stable and predictable access pattern, yet malicious intrusions or misconfigurations may subtly deviate from these norms. Traditional anomaly detection methods based on keyword matching or supervised learning fall short in such contexts due to SQL syntax variability, semantic ambiguity and the lack of labelled data. To address these challenges, this paper proposes an unsupervised anomaly detection framework centred on structured semantic intent modelling. First, we introduce a hierarchical intent abstraction that maps each SQL query into a semantic triplet, capturing its operational action, data access scope and risk semantics. This representation bridges the gap between syntax and behaviour, enabling the detection of fine‐grained threats, such as unauthorized privilege escalation and sensitive data exposure. Second, we employ a lightweight Transformer encoder trained on serialized abstract syntax trees (ASTs) to infer multi‐label intent tags, preserving syntactic structure while maintaining computational efficiency. This structure‐aware modelling significantly enhances robustness against query variability. Third, we integrate the extracted semantic intents with contextual access metadata and apply density‐based clustering to discover behavioural deviations. This design is well‐suited for integrated power grid databases, where each business system exhibits stable and identifiable access patterns. Experimental results on simulated logs from integrated power grid platforms demonstrate that our method achieves high detection accuracy while maintaining interpretability, successfully identifying previously unseen behaviours such as cross‐domain data access, unauthorized privilege escalation and silent bulk deletions.