A user Abnormal Behavior Recognition Model based on CatBoot
Huimin Zhu, Mingxi Guan, Mengqing Ma, YaQi Wang, JiaMing Ren, Peng Yu Zhao · 2022
Based on the current network security problems occur frequently. By collecting bash operation logs of Linux servers we further identify abnormal operation behaviors to identify the operation habits of specific users and maintain network security. In this paper we have built a high performance abnormal behavior recognition model based on CatBoost. Schonlau published Linux operation training data on his personal website as our data set. We first use word frequency statistical processing to characterize the data structure we want and then introduce it into our training model through data segmentation. Finally our model has an accuracy of more than 97% which is more prominent than the classical integration model and the traditional binary classification model. It has good advantages for identifying abnormal user operation behavior.