# Algorithm suggestion for anomaly detection in multivariate time series data

I have time series data containing user actions at certain time intervals eg

Date                 UserId   Directory  operation      Result
01/01/2017 99:00     user1    dir1       created_file   success
01/01/2017 99:00     user3    dir10      deleted_file   permission_denied


unique userIds > 10K 10 distinct operations

and 4 distinct Results

I need to perform anomaly detection on user behavior in real time. Any suggestions on which method I should use?

The anomaly needs to flag whether some user operations are outliers

A very small subset of input data will be labelled. But most of the data will be unlabelled.

A good metric is the entropy (dispersion) $$H = -\sum_{l=1}^{L}p_l\ln p_l$$ (is 0 if all manifestations of the categorical variable are concentrated at one label; is $$\ln L$$ if all manifestations are uniformly distributed). and the Gini-index $$\text{G}=1-\sum_{l=1}^{L}p^2_l$$ (tends to zero if one label is very dominant, becomes larger for uniformly distributed labels for a variable and is bounded by $$1-1/L$$). The variable $$p_l$$ is the relative frequency of the $$l^{\text{th}}$$ manifestation of the categorical variable that we are investigating and $$L$$ is the number of all possible manifestations of the categorical variable.