ANALYSIS OF CURRENT PROBLEMS OF SECURITY OF CORPORATE DATABASES IN THE CONDITIONS OF MODERN INFRASTRUCTURE AND WAYS TO SOLUTION THEM

This research focuses on analyzing the current security challenges of corporate databases within modern infrastructure, developing a model for detecting anomalous database access activity, and integrating it into the AlienVault SIEM system for automatic threat response. One of the main issues in database security is the need for immediate anomaly detection and response to threats affecting database availability, confidentiality, and integrity. The analysis of scientific literature led to the conclusion that modern infrastructure significantly changes the approach to corporate database security, creating both new opportunities and threats. The challenges associated with the impact of modern infrastructure on database security require new ways to solve problems and a proactive integrated approach, which consists in applying artificial intelligence in organizing the protection of corporate databases.. The study employs the IsolationForest algorithm to develop an anomaly detection model for database access, utilizing open-source Python libraries. The model was trained on historical data, followed by testing and evaluating its effectiveness using Accuracy, Precision, Recall, and ROC AUC metrics. The training process achieved a high level of anomaly detection accuracy (Accuracy = 98.8%, ROC AUC ≈ 0.99, Precision = 0.86, Recall = 0.99). The model's integration into AlienVault was implemented through an external script execution mechanism. The developed model enables real-time identification of potential threats, risk assessment, and automatic blocking of malicious requests or sending alerts to the Security Operations Center (SOC). A novel approach to integrating machine learning algorithms into SIEM systems has been proposed, ensuring proactive anomaly detection and response to database security threats. Implementing this model enhances corporate database security, reduces the risk of data leaks, and ensures prompt responses to cybersecurity incidents.