1. A method for detecting anomalies for a database system, comprising: extracting one or more workload features from a query optimizer based on a query workload of legitimate database queries, the workload features including numerical, categorical, Boolean and set-valued features appearing in the legitimate database queries; generating a submodel for each of the one or more extracted workload features; extracting values of the workload features from the query optimizer based on a database query instance; and comparing a value of each workload feature of the database query instance to prediction values of the submodel to produce a decision being one of legitimate and suspicious for each workload feature and reporting an anomaly based on an overall decision that is based on decisions for all of the workload features before the database query instance is applied to the database system.