Systems and methods for database access monitoring are provided. The system comprises at least one processor and a memory storing instructions which when executed by the at least one processor configure the at least one processor to perform the method. The method comprises receiving login event data, generating a vector representation of a subject entity and a vector representation of an object entity associated with a login event in the login event data, determining a distance between the subject entity and the object entity, and determining an anomaly score for the subject entity and the object entity. The anomaly score based at least in part on the distance between the subject entity and object entity.