A method, comprising: accessing a first plurality of user-generated database queries executed by a plurality of different users on one or more databases; extracting , from each user-generated database query in the first plurality of user-generated database queries, a corresponding set of features representing different characteristics of the user-generated database query, wherein the different characteristics comprise at least one of a length of the user-generated database query, a format of the user-generated database query, or a styling of the user-generated database query; creating a set of artificial intelligence, Al, training data based on the corresponding sets of features; training a machine learning ML, classifier using the set of Al training data and corresponding labels for each of the first plurality of database queries, wherein each of the labels indicates an identity of one of the plurality of different users that is associated with a corresponding query, wherein the trained ML classifier is configured to produce vector outputs in a vector space in response to receiving database queries; extracting, by a computer system, from a first user-generated database query associated with a first user, a first set of features representing different characteristics of the first user-generated database query ; obtaining a first output vector in the vector space based on providing the first set of features to the trained ML classifier; and based on the first output vector, determining , by the computer system, if the first user-generated database query represents a data access anomaly. accessing a first plurality of user-generated database queries executed by a plurality of different users on one or more databases; extracting , from each user-generated database query in the first plurality of user-generated database queries, a corresponding set of features representing different characteristics of the user-generated database query, wherein the different characteristics comprise at least one of a length of the user-generated database query, a format of the user-generated database query, or a styling of the user-generated database query; creating a set of artificial intelligence, Al, training data based on the corresponding sets of features; training a machine learning ML, classifier using the set of Al training data and corresponding labels for each of the first plurality of database queries, wherein each of the labels indicates an identity of one of the plurality of different users that is associated with a corresponding query, wherein the trained ML classifier is configured to produce vector outputs in a vector space in response to receiving database queries; extracting, by a computer system, from a first user-generated database query associated with a first user, a first set of features representing different characteristics of the first user-generated database query ; obtaining a first output vector in the vector space based on providing the first set of features to the trained ML classifier; and based on the first output vector, determining , by the computer system, if the first user-generated database query represents a data access anomaly. <EOS>