1. A computer program product for aggregating and presenting a database intrusion incident, the computer program product comprising a computer-readable storage medium containing executable computer program code for: receiving, from a database intrusion detection system, an anomalous database query requesting data from a database, the database intrusion detection system configured to separate acceptable database queries from anomalous database queries that are expected to have undesired effects on the database, wherein database queries are determined to be anomalous when the database queries differ from the acceptable database queries observed by the database intrusion detection system, the anomalous database query having at least one anomalous attribute; identifying an anomaly type for the anomalous database query received, the anomaly type defining a category of anomalous database queries having similar anomalous attributes; converting the anomalous database query into a characteristic representation, the characteristic representation describing the anomalous attribute of the anomalous database query in a generic form for grouping according to the anomaly type; aggregating the anomalous database query and other anomalous database queries with substantially similar characteristic representations into a group of anomalous database queries to represent a single intrusion incident, wherein the other anomalous database queries are identified for aggregation into the group using an index generated based on the characteristic representation of the anomalous database query; and generating a database intrusion incident report describing the group of anomalous database queries.
1. A computer program product for aggregating and presenting a database intrusion incident, the computer program product comprising a computer-readable storage medium containing executable computer program code for: receiving, from a database intrusion detection system, an anomalous database query requesting data from a database, the database intrusion detection system configured to separate acceptable database queries from anomalous database queries that are expected to have undesired effects on the database, wherein database queries are determined to be anomalous when the database queries differ from the acceptable database queries observed by the database intrusion detection system, the anomalous database query having at least one anomalous attribute; identifying an anomaly type for the anomalous database query received, the anomaly type defining a category of anomalous database queries having similar anomalous attributes; converting the anomalous database query into a characteristic representation, the characteristic representation describing the anomalous attribute of the anomalous database query in a generic form for grouping according to the anomaly type; aggregating the anomalous database query and other anomalous database queries with substantially similar characteristic representations into a group of anomalous database queries to represent a single intrusion incident, wherein the other anomalous database queries are identified for aggregation into the group using an index generated based on the characteristic representation of the anomalous database query; and generating a database intrusion incident report describing the group of anomalous database queries. 3. The computer program product of claim 1 , wherein the anomaly type for the query received is selected from a group consisting of: anomalous query text that has not been previously received, anomalous parameters but known query text that has been previously received, and anomalous code injected into known query text that has been previously received.