Aspects described herein may allow for the application of an artificial neural network architecture to identify intrusion in a database. Changes to components of a data table of the database may be tracked as a snapshot of the changes over a period of time. Any change in the data table may be associated with a user. Utilizing multiple snapshots, a background substitution technique may be utilized to generate a matrix of the changes to the data table over a period of time. A model having an artificial neural network architecture may utilize the matrix as an input set to identify the user as an unauthorized user accessing the database.