Detecting anomalous user behavior using generative models of user actions

Patent metadata

Field	Value
Publication number	US-9558347-B2
Application number	US-201314011213-A
Country	US
Kind code	B2
Filing date	Aug 27, 2013
Priority date	Aug 27, 2013
Publication date	Jan 31, 2017
Grant date	Jan 31, 2017

Abstract

A method for detecting abnormal behavior of users is disclosed. Processors identify from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users. Processors also identify from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity. Processors calculate an amount of deviation between the first number of actions and the second number of actions. The deviation identifies a difference between amounts of time spent in the one or more roles. Processors then determine whether the amount of deviation between the first number of actions and the second number of actions exceeds a threshold for abnormal behavior.

First claim

What is claimed is:

1. A method for detecting abnormal behavior of users, the method comprising:
identifying, by one or more processors and from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users, wherein each of the one or more roles represents an authority associated with one or more of the users;
identifying, by the one or more processors and from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity for the task associated with the one or more roles;
identifying a difference between amounts of time spent in the one or more roles in the first time period and the second time period based on the first number of actions and the second number of actions; and
determining, by the one or more processors, whether the difference exceeds a threshold for abnormal behavior.

2. The method of claim 1 , further comprising:
generating the one or more roles from the log of user activity based on actions of the users over a period of time selected for determining the one or more roles of the users.

3. The method of claim 2 , wherein the generating of the one or more roles further comprises using role mining methods to identify the one or more roles.

4. The method of claim 3 , wherein the role mining methods comprise one or more of discrete and probabilistic role mining, single and multi-clustering algorithms, latent Dirichlet allocation, and hidden topic Markov models.

5. The method of claim 1 , wherein the first number of actions and the second number of actions are performed on one or more resources, and further comprising:
identifying the one or more roles based in part on the one or more resources the first number of actions and the second number of actions are performed on.

6. The method of claim 1 , wherein the threshold for abnormal behavior is one of a threshold for abnormal behavior of the user, a threshold for abnormal behavior of the user in the one or more roles, a threshold for abnormal behavior of the users, and a threshold for abnormal behavior of the users in the one or more roles.

7. The method of claim 1 , further comprising:
generating, by the one or more processors, a report of abnormal behavior responsive to a determination that the difference exceeds the threshold for abnormal behavior.

8. The method of claim 7 , wherein the report of abnormal behavior comprises an alert.

9. The method of claim 1 , wherein identifying the difference between the amounts of time spent in the one or more roles in the first time period and the second time period based on the first number of actions and the second number of actions comprises:
dividing, by the one or more processors, the first number of actions performed by the user over the first time period into a number of subgroups of actions performed by the user over a number of subintervals of time that are disjoint and continuous over the first time period; and
determining one or more amounts of deviation between the second number of actions and each of the number of subgroups, wherein the difference is based on the one or more amounts of deviation.

10. The method of claim 1 , wherein identifying the difference between amounts of time spent in the one or more roles in the first time period and the second time period based on the first number of actions and the second number of actions comprises:
calculating an amount of deviation between the first number of actions and the second number of actions to identify the difference.

11. The method of claim 10 , wherein calculating the amount of deviation between the first number of actions and the second number of actions comprises:
fitting the first number of actions to a model for roles to determine a first list of role fitness values that represents a degree to which the user belongs to each of the one or more roles within the first time period;
fitting the second number of actions to the model for roles to determine a second list or role fitness values that represents a degree to which the user belongs to each of the one or more roles within the second time period; and
comparing the first list of role fitness values with the second list of role fitness values to determine the deviation.

12. A method for detecting abnormal behavior of users, the method comprising:
identifying, by the one or more processors and from a log of user activity, a first number of actions performed by a user over a first time period that match a first pattern of user activity for a first task associated with one or more first roles of the users, and a second number of actions performed by the user over the first time period that match a second pattern of user activity for a second task associated with one or more second roles of the users, wherein each of the one or more first roles and the one or more second roles represents an authority that is associated with one or more of the users; and
identifying, by the one or more processors and from the log of user activity, a third number of actions performed by the user over a second time period that match the first pattern of user activity for the first task associated with the one or more first roles, and a fourth number of actions performed by the user over the second time period that match the second pattern of user activity for the second task associated with the one or more second roles;
identifying, by the one or more processors, a difference between time spent by the user in the one or more first roles and the one or more second roles in the first time period and time spent by the user in the one or more first roles and the one or more second roles in the second time period based on the first number of actions, the second number of actions, the third number of actions, and the fourth number of actions; and
determining, by one or more processors, whether the difference exceeds a threshold for abnormal behavior.

13. The method of claim 12 , wherein the first task and the one or more first roles differs from the second task and the one or more second roles.

14. The method of claim 12 , wherein identifying the difference between time spent by the user in the one or more first roles and the one or more second roles in the first time period and time spent by the user in the one or more first roles and the one or more second roles in the second time period based on the first number of actions, the second number of actions, the third number of actions, and the fourth number of actions comprises:
identifying a first amount of time spent by the user performing the first number of actions, a second amount of time spent by the user performing the second number of actions, a third amount of time spent by the user performing the third number of actions, and a fourth amount of time spent by the user performing the fourth number of actions;
identifying a first ratio of time spent by the user between the first amount of time and the second amount of time in the first time period;
identifying a second ratio of time spent by the user between the third amount of time and the fourth amount of time in the second time period; and
calculating, as the difference between time spent by the user in the one or more first roles and the one or more second roles in the first time period and time spent by the user in the one or more first roles and the one or more second roles in the second time period, a difference between the first ratio and the second ratio.

15. A method for detecting abno

Assignees

• Globalfoundries Inc

Inventors

• Chari Suresh N
• Molloy Ian M
• Park Youngja
• Teiken Wilfried

Classifications

• G06N20/00

  Machine learning · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• H04L63/1425

  Traffic logging, e.g. anomaly detection · CPC title

• H04L63/1483

  service impersonation, e.g. phishing, pharming or web spoofing (detection of rogue wireless access points H04W12/12) · CPC title

• G06F21/50 Primary

  Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems · CPC title