# To detect unauthorized access using outlier detection

I am working on project where my task is to find unauthorized access using any machine learning technique.

Let me clear my problem definition.

1. UserA access website using chrome browser from windows PC.
2. UserB access website using Internet Explorer from windows PC.
3. UserA never use safari to access website but all of a sudden it uses safari to access website from mac system.

Point 1 and 2 are normal logins but point 3 may be used by attackers because it is not matching with UserA behavior.

Thus i am am trying to implement an unsupervised model in python to first learn normal behaviors of all users for website access with other features such as -

• country
• service_key (unique identifier)
• system
• app_type (client, server, enterprise etc.)

Below I am sharing sample data-set of mine.

+==========+=========+=============+=========+==========+
| username | country | service_key | system  | app_type |
+==========+=========+=============+=========+==========+
| userA    | india   | e08fe2d     | windows | 2        |
| userA    | india   | e08fe2d     | android | 2        |
| usreB    | china   | bb15d36     | windows | 3        |
| userB    | india   | bb15d36     | windows | 3        |
| userB    | russia  | bb15d36     | mac     | 3        |

| userA    | usa     | e08fxxx     | mac     | 3        |
| userB    | china   | bb1xxxx     | ios     | 1        |
+==========+=========+=============+=========+==========+


Above 5 records are manually analyzed and marked as normal logs and collected from different users system. But the last 2 records are abnormal and should be detected as outlier because their is no match in features. Here to be note is that logins can have different country and system but it cannot have different username, service_key and app_type.

Can anyone suggest me to model this or can share blog or samples in python?

• Are you familiar with anomaly detection? – Media Feb 5 '18 at 14:06
• No. This is the first time i am working on this kind of problem. – Nilesh Shaikh Feb 5 '18 at 14:09
• I cannot comment because of reputation. However, I am facing the exact same task, though in a different context. My question is here: stats.stackexchange.com/questions/326906/… Unfortunately, no useful insights yet. Can you share the link of your question on coursera to keep us update? It is very important! – Seymour Feb 5 '18 at 16:27

This question is quite broad. I'll try to set you on the right path, more so than providing a truly complete answer.

Theoretical background

As others have mentioned, the task you're trying to do is usually known as anomaly detection, also known as novelty detection.

There's many possible ways to approach this kind of task, depending on the assumptions you are willing to make about your data.

Before we start exploring alternatives, it's important to mention here that all your variables are categorical (country, service_key, system, app_type). This is important, since usually algorithms usually handle either continuous variables or discrete variables, and categorical ones fall into the latter type.

There's some tricks you can do, however, to handle them interchangeably. One-hot encoding is simple and popular, and enables you to transform a categorical variable into N binary variables. For some classes of algorithms, you can then use these binary variables as if they were continuous. You can even mix binary and truly continuous variables.

Now, there's usually two families of methods to approach this sort of problem: parametric vs non-parametric.

Parametric methods require that you do assumptions on the underlying probability distributions of your data. You can then estimate these parameters using your data.

Non-parametric methods, on the other hand, are simpler to use, as they don't require assuming a underlying distribution. They might also be less powerful / exact, especially if you don't have a lot of data and your data very closely follows a known probability distribution.

If you're willing to do some statistical work, look into bayesian inference.

For a easier non-parametric method, look into into One-Class SVM. Here is a code example using python and scikit-learn and more practical information on anomaly detection

But, honestly, you're giving us a important clue here:

Here to be note is that logins can have different country and system but it cannot have different username, service_key and app_type.

If you already know all this, you might want to completely skip the complicated parts. Just compare those values directly, summarize them into a distance measure (you can give different weights to service_key and app_type, for example) and see if that's good enough

I guess you need anomaly detection algorithm. It is like fraud detection for finding abnormal behaviors.

In data mining, anomaly detection (also outlier detection) is the identification of items, events or observations which do not conform to an expected pattern or other items in a dataset. Typically the anomalous items will translate to some kind of problem such as bank fraud, a structural defect, medical problems or errors in a text. Anomalies are also referred to as outliers, novelties, noise, deviations and exceptions.

I highly recommend you taking a look at here.

• Andrew Ng anomaly detection is massively based on Gaussian repartition, I wonder if there is another way to do this ? – MaxouMask Feb 5 '18 at 15:51
• @MaxouMask you mean other distributions? – Media Feb 5 '18 at 16:07
• Yes but I guess I will ask my question directly on coursera. I'm not sure it's suitable to ask it here :D – MaxouMask Feb 5 '18 at 16:12
• @MaxousMask sure, but there is an explanation for that I guess. central limit theorem if I remember about sampling. – Media Feb 5 '18 at 16:22

This is a scenario where you need a meta-dataset. The sample data that you posted is not something that is ready for modeling. I would work towards developing a dataset that would establish the same patterns that you listed in the rest of your post. How many countries have they logged in from? How many times was it during the day? At night? etc. To be clear, this would be a dataset where it's one user ID per row, and each ID only has one record. If you can develop that, then you will be in a much better position to model this out.

• So, if I understand you right, the result of that meta-dataset would somewhat be like a one hot encoded set, but instead of the binary values we use the frequency of the values? Like User with ID XY has accessed the Side 0 times from USA, 2 times from India and so on? – RyanMcFlames Feb 5 '18 at 14:51
• @RyanMcFlames I won't get caught up in semantics of what it should be called, but yes, you're generally on the right track. I like to think of it as being similar to a GROUP BY statement that you might use in SQL in the sense that you want to narrow down your data to one row per user/ID and then a column that represents each of their behaviors or a call out to a relational table for those behaviors. – I_Play_With_Data Feb 5 '18 at 15:06