An Ensemble Approach for Detecting Anomalous User Behaviors
Xiangyu Xi, Tong Zhang, Wei Ye, Wen Ping Zhao, Shikun Zhang, Dongdong Du, Qing Zhong Gao · International Journal of Software Engineering and Knowledge Engineering · 2018
An intruder of a company’s network may use stolen login credentials to silently collect sensitive data. Such malicious user behavior is difficult to detect as long as it does not trigger access violation or data leak alert. In this paper, we propose to use an ensemble of three unsupervised anomaly detection algorithms, namely OCSVM, RNN and Isolation Forest, to detect abnormal user behavior patterns. Besides, an User Behavior Analytics (UBA) Platform is proposed to collect logs, extract features and conduct experiments. The experiment results indicate that our algorithm outperforms each individual algorithm with recall of 96.55% and precision of 91.24% on average, while both OCSVM and RNN suffer from anomalies in the training set, and [Formula: see text] produces more false positives and false negatives in prediction.