I feel this is the wrong way to go about it. Even if you knew that someone has breached the system, it might be too late to prevent damage. Also, if the someone is proficient enough, he'll detect an unshielded Ubuntu system and try to break in, say, one Friday evening. By the time Monday morning comes, the logs might show nothing and the system will report business as usual with a straight face and an earnest expression.
What you want is that nobody connects to the system.
If you do not need connections from anywhere else but localhost, do not even bind the interface. You can skip TCP networking altogether and only connect through a local socket (if memory serves, there's a setting in my.cnf - something like skip-networking or skip-tcp-networking).
If you need to use TCP connections, then use the firewall to deny any inbound connections to port 3306/tcp on all interfaces except 'lo', localhost.
This will consume next to no resources, and will give you far greater security and peace of mind. Of course nothing stops you from doing both - prevent logins, and log any that might nonetheless somehow succeed.