To detect unauthorized access using outlier detection

Question

I am working on project where my task is to find unauthorized access using any machine learning technique.

Let me clear my problem definition.

1. UserA access website using chrome browser from windows PC.
2. UserB access website using Internet Explorer from windows PC.
3. UserA never use safari to access website but all of a sudden it uses safari to access website from mac system.

Point 1 and 2 are normal logins but point 3 may be used by attackers because it is not matching with UserA behavior.

Thus i am am trying to implement an unsupervised model in python to first learn normal behaviors of all users for website access with other features such as -

• username
• country
• service_key (unique identifier)
• system
• app_type (client, server, enterprise etc.)

Below I am sharing sample data-set of mine.

+==========+=========+=============+=========+==========+
| username | country | service_key | system  | app_type |
+==========+=========+=============+=========+==========+
| userA    | india   | e08fe2d     | windows | 2        |
| userA    | india   | e08fe2d     | android | 2        |
| usreB    | china   | bb15d36     | windows | 3        |
| userB    | india   | bb15d36     | windows | 3        |
| userB    | russia  | bb15d36     | mac     | 3        |

| userA    | usa     | e08fxxx     | mac     | 3        |
| userB    | china   | bb1xxxx     | ios     | 1        |
+==========+=========+=============+=========+==========+

Above 5 records are manually analyzed and marked as normal logs and collected from different users system. But the last 2 records are abnormal and should be detected as outlier because their is no match in features. Here to be note is that logins can have different country and system but it cannot have different username, service_key and app_type.

Can anyone suggest me to model this or can share blog or samples in python?

Answer 1

This question is quite broad. I'll try to set you on the right path, more so than providing a truly complete answer.

---

Theoretical background

As others have mentioned, the task you're trying to do is usually known as anomaly detection, also known as novelty detection.

There's many possible ways to approach this kind of task, depending on the assumptions you are willing to make about your data.

---

Before we start exploring alternatives, it's important to mention here that all your variables are categorical (country, service_key, system, app_type). This is important, since usually algorithms usually handle either continuous variables or discrete variables, and categorical ones fall into the latter type.

There's some tricks you can do, however, to handle them interchangeably. One-hot encoding is simple and popular, and enables you to transform a categorical variable into N binary variables. For some classes of algorithms, you can then use these binary variables as if they were continuous. You can even mix binary and truly continuous variables.

---

Now, there's usually two families of methods to approach this sort of problem: parametric vs non-parametric.

Parametric methods require that you do assumptions on the underlying probability distributions of your data. You can then estimate these parameters using your data.

Non-parametric methods, on the other hand, are simpler to use, as they don't require assuming a underlying distribution. They might also be less powerful / exact, especially if you don't have a lot of data and your data very closely follows a known probability distribution.

---

Practical advise

If you're willing to do some statistical work, look into bayesian inference.

For a easier non-parametric method, look into into One-Class SVM. Here is a code example using python and scikit-learn and more practical information on anomaly detection

But, honestly, you're giving us a important clue here:

Here to be note is that logins can have different country and system but it cannot have different username, service_key and app_type.

If you already know all this, you might want to completely skip the complicated parts. Just compare those values directly, summarize them into a distance measure (you can give different weights to service_key and app_type, for example) and see if that's good enough

Answer 2

I guess you need anomaly detection algorithm. It is like fraud detection for finding abnormal behaviors.

In data mining, anomaly detection (also outlier detection) is the identification of items, events or observations which do not conform to an expected pattern or other items in a dataset. Typically the anomalous items will translate to some kind of problem such as bank fraud, a structural defect, medical problems or errors in a text. Anomalies are also referred to as outliers, novelties, noise, deviations and exceptions.

I highly recommend you taking a look at here.

Answer 3

This is a scenario where you need a meta-dataset. The sample data that you posted is not something that is ready for modeling. I would work towards developing a dataset that would establish the same patterns that you listed in the rest of your post. How many countries have they logged in from? How many times was it during the day? At night? etc. To be clear, this would be a dataset where it's one user ID per row, and each ID only has one record. If you can develop that, then you will be in a much better position to model this out.