I have user data login logs from Active directory data that lists when a user was logged in to a server. I am looking to find a deviation in the normal behavior of the user. For example if a user is usually active from say 9am to 5pm, if there is some activity outside this, it should be detected. I am unsure if the min(first logon) and the max(last logon) should be considered. Any input will be appreciated.
3
-
$\begingroup$ Are you asking for help in how to calculate this from a file, or what calculation to do to detect outliers? $\endgroup$– CalZCommented Mar 30, 2017 at 17:58
-
$\begingroup$ @CalZ , from a file as plotting again and again would be difficult. $\endgroup$– kruparulz14Commented Mar 30, 2017 at 20:15
-
$\begingroup$ You can easily calculate the activity histogram using SQL, reading the CSVs with something like Spark or Drill. If you want to go the next step, you can model the activity's conditional distribution (based on the day, or some other state). Once you have the distribution, it is easy to calculate the probability of activity in some interval. Then you simply compare this probability with a threshold to declare it anomalous or not. $\endgroup$– EmreCommented Mar 30, 2017 at 20:19
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
As always, start by looking at the data. Pick a user, and look at their typical login times. Maybe plot a histogram to show the distribution of time of day of their login. Pick another user, and look at them. Pick a few more. Do you see any patterns? Do they have a common shape? Do users fall into a few clusters? Try to understand the data well.
Then, once you have a feeling for what normal behavior tends to look like, and how it varies from user to user, you can start to think about how to build a model that captures this random behavior and helps you distinguish normal vs abnormal behavior (perhaps by some kind of anomaly detection).
But as always: start by visualizing the data. Asking how to approach the problem or what machine learning method to use is premature, until you have a better understanding of the data.
-
$\begingroup$ every user has different behavior meaning every user has a different cluster (visualized the data to conclude this). But I'm afraid if k means clustering can be used for this. $\endgroup$ Commented Apr 10, 2017 at 20:55
$\begingroup$
$\endgroup$
Ok, this is a very exciting problem. Quite different than the ones we usually see on this site. And, even more exciting is that I think that one of the oldest methods in the book is what you are truly looking for.
So from what I gather, you have the time that a user is active per day as your data and you want to determine times when they log on that deviates away from their usual activity.
Ex: User 1, active from 9:00am to 15:00pm.
This is often called anomaly detection. You are trying to detect when a behavior from a specific user is anomalous (different) than their normal. So how is this done?
Anomaly detection algorithms are capable of learning the distribution a single set of labels (normal activity) and then it will be able to flag when an anomaly occurs (anomalous activity). This is when an instance is sufficiently different than the learned distribution.
To get the baseline distribution in your case it is very easy which makes it quite exciting! All you need to do is collect information about the user during a burn-in period. Here you need to make a choice. Do you want to track the users activity daily, or throughout the week, the month? etc... If we are talking about activity in a server that is used for work, weekly would likely be better. However, if it's a gaming server then maybe daily is better. You need to think about the regularity of the users schedule in regards to the kind of server you are hosting. Let's assume you are interested in their daily activity. Then you can have a burn-in period of a few weeks.
So set up a probability graph which will be your probability distribution function. The $x$-axis is going to be the hours of the day, and the $y$-axis will be the frequency (you will need this to be normalized afterwards for the math to work out). So, each time the user logs on, you will add onto the plot a box unit 1 ($y$-axis) for that time slot. This is essentially a histogram!! At the end you will end up with a curve that shows the likelihood of the user being active for any given hour of the day.
Now, if you see that a user logs on at a time $X$, you can use the probability density function to get the probability of the event having been drawn from that distribution. In other words, what is the likelihood that the user would be online at a time $X$. If this likelihood is below a threshold $\alpha$ then you are safe to assume that it is anomalous. This is more commonly known as the generalized likelihood ratio test (GLRT).
The disadvantage of this technique is that you need to train the hyper-parameter $\alpha$, your threshold. Which is easy to do given you have labeled data. You know what behavior is normal/anomalous. If you don't have this information. You can just set an arbitrary threshold and fix it as you see fit based on the resulting false positive or false negative rates you will encounter.
I am suggesting this because you can easily get the parametrization of your probability distribution. So if you do not use it you are missing out on a lot of information.
Another non-parametric way to do anomaly detection would be to use a specialized K-NN method which makes use of the $p$-statistic test in a very clever way. I have found a lot of success on very limited datasets using their methods. The paper you should start with is:
Learning Minimum Volume Sets and Anomaly Detectors from KNN Graphs https://arxiv.org/pdf/1601.06105.pdf
And then you can go onto their simplest implementation, which you can then expand on by reading their other papers (bagging, ranking, etc...)
Anomaly detection with score functions based on nearest neighbor graphs https://papers.nips.cc/paper/3723-anomaly-detection-with-score-functions-based-on-nearest-neighbor-graphs.pdf
