I am working on project where my task is to find unauthorized access using any machine learning technique.
Let me clear my problem definition.
- UserA access website using chrome browser from windows PC.
- UserB access website using Internet Explorer from windows PC.
- UserA never use safari to access website but all of a sudden it uses safari to access website from mac system.
Point 1 and 2 are normal logins but point 3 may be used by attackers because it is not matching with UserA behavior.
Thus i am am trying to implement an unsupervised model in python to first learn normal behaviors of all users for website access with other features such as -
- username
- country
- service_key (unique identifier)
- system
- app_type (client, server, enterprise etc.)
Below I am sharing sample data-set of mine.
+==========+=========+=============+=========+==========+
| username | country | service_key | system | app_type |
+==========+=========+=============+=========+==========+
| userA | india | e08fe2d | windows | 2 |
| userA | india | e08fe2d | android | 2 |
| usreB | china | bb15d36 | windows | 3 |
| userB | india | bb15d36 | windows | 3 |
| userB | russia | bb15d36 | mac | 3 |
| userA | usa | e08fxxx | mac | 3 |
| userB | china | bb1xxxx | ios | 1 |
+==========+=========+=============+=========+==========+
Above 5 records are manually analyzed and marked as normal logs and collected from different users system. But the last 2 records are abnormal and should be detected as outlier because their is no match in features. Here to be note is that logins can have different country and system but it cannot have different username, service_key and app_type.
Can anyone suggest me to model this or can share blog or samples in python?