23. A computer system for a database intrusion system for aggregating and presenting a database intrusion incident, the computer system comprising: a computer-readable storage medium configured to store software modules comprising: a receiving module configured to receive, from a database intrusion detection system, an anomalous database query requesting data from a database, the database intrusion detection system configured to separate acceptable database queries from anomalous database queries that are expected to have undesired effects on the database, wherein database queries are determined to be anomalous when the database queries differ from the acceptable database queries observed by the database intrusion detection system, the anomalous database query having at least one anomalous attribute; a type-identification module configured to identify an anomaly type for the query received, the anomaly type defining a category of anomalous database queries having similar anomalous attributes; a conversion module configured to convert the anomalous database query into a characteristic representation, the characteristic representation describing the anomalous attribute of the anomalous database query in a generic form for grouping according to the anomaly type; an aggregation module configured to aggregate anomalous database queries the anomalous database query and other with substantially similar characteristic representations into a group of anomalous database queries to represent a single intrusion incident, wherein the other anomalous database queries are identified for aggregation into the group using an index generated based on the characteristic representation of the anomalous database query; a generation module configured to generate a database intrusion incident report describing the group of anomalous database queries; and a processor configured to execute the software modules stored by the computer-readable storage medium.
23. A computer system for a database intrusion system for aggregating and presenting a database intrusion incident, the computer system comprising: a computer-readable storage medium configured to store software modules comprising: a receiving module configured to receive, from a database intrusion detection system, an anomalous database query requesting data from a database, the database intrusion detection system configured to separate acceptable database queries from anomalous database queries that are expected to have undesired effects on the database, wherein database queries are determined to be anomalous when the database queries differ from the acceptable database queries observed by the database intrusion detection system, the anomalous database query having at least one anomalous attribute; a type-identification module configured to identify an anomaly type for the query received, the anomaly type defining a category of anomalous database queries having similar anomalous attributes; a conversion module configured to convert the anomalous database query into a characteristic representation, the characteristic representation describing the anomalous attribute of the anomalous database query in a generic form for grouping according to the anomaly type; an aggregation module configured to aggregate anomalous database queries the anomalous database query and other with substantially similar characteristic representations into a group of anomalous database queries to represent a single intrusion incident, wherein the other anomalous database queries are identified for aggregation into the group using an index generated based on the characteristic representation of the anomalous database query; a generation module configured to generate a database intrusion incident report describing the group of anomalous database queries; and a processor configured to execute the software modules stored by the computer-readable storage medium. 29. The system of claim 23 , wherein the aggregation module is further configured aggregate the anomalous database query based on query text and on user name.