1. A computer-implemented method for training a database intrusion detection system in real time, said method comprising the steps of: observing, in real time, commands that are accessing the database during a training phase; establishing categories responsive to the observed commands; grouping the commands into the categories; performing a statistical analysis of the categories, the analysis comprising determining whether a predetermined threshold number of categories has been exceeded; deriving from said commands, in real time, a set of acceptable commands; and ending the training phase responsive to a determination that the predetermined threshold number of categories has been exceeded.