# How can I turn user audit data into behavior clusters?

I have logs of user activity on my system. This is a CMS system.

The logs consist of:

• User ID
• Action Performed (one of 110 possible actions - things like page edited, page read, login, etc.)
• Site action was performed on (not relevant for all possible actions)
• Object action was performed on (document name or document id - not relevant for all possible actions)
• Date and time that the action was performed

I would like to use this data to cluster users into groups with similar behavior, so that I can then survey the groups to find out who they are and then target them with training interventions, newsletters etc.

I need help with converting the above list of things into clusters.

What techniques can I use to generate a matrix from the above data that I can feed into a K-Means cluster algorithm?

I tried counting action by user and using that to feed a cluster algorithm but the result was useless. I also tried treating the site and document ids as text, feature hashing that and feeding it into a K-Means cluster model, also got useless data out.

• "result was useless" how do you know? K-means is unsupervised so there is no intrinsic measurement of fitness. – Louis T Nov 8 '17 at 23:52
• Learn an embedding for each user based on their activity. Since you have time series data, treat it as a sequence prediction problem with the user embedding as a feature or initial state. I know this description is terse so I hope someone can fill in the blanks if you need it. Welcome to the site and good luck! – Emre Nov 9 '17 at 0:23
• @LouisT for my action count matrix I ended up with a huge circular cluster containing a tiny dot of another cluster in the middle. I think there is something technically wrong with how I fed the data to the K-Means cluster algorithm, but I don't know what that might be. – Joon Nov 9 '17 at 8:26
• @Emre thanks that is an interesting approach. A bit beyond my capabilities though so maybe someone will be friendly enough to help get me started ;-) – Joon Nov 9 '17 at 8:27
• @Joon I don't understand what do you mean by "circular cluster". I am imaging a data frame, with each row represents a user and the 110 columns each represents an action. and the values of the data frame is the count of actions performed by the users. – Louis T Nov 9 '17 at 11:05

### Scaling

Standardize you data by $(x - mean(x)) / std(x)$

Most K-mean implementation by default uses Euclidean distance which assumes the equal importance of all features. This requires proper scaling to prevent one action dominates the others.

### Dimensionality

K-mean is not robust against the curse of dimensionality (see this post). So as always it good to reduce you dimensionality before feed it to the algorithm.

Do some feature engineering first. For example, login and page load can be group together as a measure of passive engagement, page edit and page created could be considered as a single activate engagement feature.

Also, you can try using some standard dimensionality reduction algorithm like PCA

• Thanks Louis. One last question about the standardization for optimal clustering: Should I standardize all cells of my matrix, or only within a feature? – Joon Nov 10 '17 at 8:52
• @Joon standardize within each feature, such that each feature has zero mean and one as stdev – Louis T Nov 10 '17 at 8:56