Analysis of User’s Abnormal Behavior Based on Behavior Sequence in Enterprise Network

The dangerous and harmful factors of machinery manufacturing mainly include human unsafe behavior and consciousness factors, unsafe state factors of equipment and adverse environmental factors. The characteristics and classification of abnormal behavior are analyzed, the detection methods of operators' abnormal running behavior are compared, and the discrimination basis of operators' abnormal running behavior is analyzed. The wearable inertial sensor is studied. The acceleration sensor is used to measure the acceleration of the measured object, and the gyroscope sensor can measure the angle of the human body relative to the ground. MPU9250 is selected as the measurement tool of acceleration and angle to identify the abnormal behavior of the human body, and cooperate with the single chip microcomputer, It is conducive to the detection and early warning of abnormal behavior of mechanical operators.

Behavior evaluation is an important research topic in trustworthy network. Up to now, most effect focuses on the validity of host's and user's identity, such as integrity measurement and access control, which could not guarantee the trustworthiness of valid user's behavior. In this paper, we proposed an unsupervised method for evaluating user's network behavior and trustworthiness grades in a local network. Firstly, we collected network behavior samples as more as possible. The occasions for sampling network behavior should be distinctly various in order to guarantee the collection of samples contains all possible behavior modes in network. Secondly, after initially preprocessed, the sample data was tagged with different trustworthiness grades. Lastly, according to the graded sample data, our method constructed a support vector machine to evaluate user's latter network behavior. We applied this method to a corporation network which contained many employee terminals. The result of behavior evaluation showed that this method is reasonable and feasible.

At present, the identification of abnormal power consumption behaviors in low- and medium-sized distribution networks has problems such as low efficiency and low accuracy. For this reason, we need to apply big data mining technology to a large amount of electricity consumption data to realize the location of abnormal behavior. Based on this research background, the article proposes an abnormal power consumption recognition model based on the improved K-means algorithm. The model classifies user load curves, extracts characteristic curves and analyzes typical characteristics of their electricity consumption behavior. In this way, the abnormal behavior of electricity consumption in the distribution network is identified. Through experimental analysis, it is found that the optimized K-means clustering algorithm can accurately realize the classification and recognition function of different user types. At the same time, the algorithm can more accurately and effectively analyze the abnormal behavior of users' electricity consumption.

Performing log audit on operation logs, we can effectively discover the abnormal behavior of malicious users and minimize the losses. To this end, a storage and matching method based on the prefix tree for abnormal behavior rules is proposed to realize the rapid detection of abnormal behavior in the logs. However, unknown abnormal behavior could not be detected by this method. Therefore, we have also defined a variety of tags to constitute user portrait of normal user in advance. The user behavior characteristics are acquired through various means. Matching with the user portrait, we can discover the abnormal behavior of test data. The experiment result shows that the detection is fast and accurate by combining these two methods.

Internal user threat detection is an important research problem in the field of system security. Recently, the analysis of abnormal behaviors of users is divided into supervised learning method (SID) and unsupervised learning method (AD). However, supervised learning method relies on domain knowledge and user background, which means it cannot detect previously unknown attacks and is not suitable for multi-detection domain scenarios. Most existing AD methods use the clustering algorithm directly. But for threat detection on internal users’ behavior, mostly for high-dimensional cross-domain log files, as far as we know, there are few methods of multi-domain audit log data with effective feature extraction. An effective feature extraction method which can not only reduce testing cost greatly, but also detect the abnormal behavior of users more accurately. We propose a new unsupervised log abnormal behavior detection method which is based on the denoising autoencoders to encode the user log file, and adopts the integrated method to detect the abnormal data after encoding. Compared with the traditional detection method, it can analyze the abnormal information in the user behavior more effectively, thus playing a preventive role against internal threats. In addition, the method is completely data driven and does not rely on relevant domain knowledge and user’s background attributes. Experimental results verify the effectiveness of the integrated anomaly detection method under the multi-domain detection scenario of user log files.

Protocol's abnormal behavior analysis is an important task in protocol reverse analysis. Traditional protocol reverse analysis focus on the protocol message format, but protocol behavior especially the abnormal behavior is rare studied. In this paper, protocol behavior is represented by the labeled behavior instruction sequences. Similar behavior instruction sequences mean the similar protocol behavior. Using our developed virtual analysis platform HiddenDisc, we can capture a variety of known or unknown protocols' behavior instruction sequences. All kinds of executed or unexecuted instruction sequences can automatic clustering by our designed instruction clustering algorithm. Thereby we can distinguish and mine the unknown protocols' potential abnormal behavior. The mined potential abnormal behavior instruction sequences are executed, monitored and analyzed on HiddenDisc to determine whether it is an abnormal behavior and what is the behavior's nature. Using the instruction clustering algorithm, we have analyzed 1297 protocol samples, mined 193 potential abnormal instruction sequences, and determined 187 malicious abnormal behaviors by regression testing. Experimental results show that our proposed instruction clustering algorithm has high efficiency and accuracy, can mine unknown protocols' abnormal behaviors effectively, and enhance the initiative defense capability of network security.

Amid rapid advancements in artificial intelligence, the detection of abnormal human behaviors in complex traffic environments has garnered significant attention. However, detection errors frequently occur due to interference from complex backgrounds, small targets, and other factors. Therefore, this paper proposes a research methodology that integrates the anomaly detection YOLO-SGCF algorithm with the tracking BoT-SORT-ReID algorithm. The detection module uses YOLOv8 as the baseline model, incorporating Swin Transformer to enhance global feature modeling capabilities in complex scenes. CBAM and CA attention are embedded into the Neck and backbone, respectively: CBAM enables dual-dimensional channel-spatial weighting, while CA precisely captures object location features by encoding coordinate information. The Neck layer incorporates GSConv convolutional modules to reduce computational load while expanding feature receptive fields. The loss function is replaced with Focal-EIoU to address sample imbalance issues and precisely optimize bounding box regression. For tracking, to enhance long-term tracking stability, ReID feature distances are incorporated during the BoT-SORT data association phase. This integrates behavioral category information from YOLO-SGCF, enabling the identification and tracking of abnormal pedestrian behaviors in complex environments. Evaluations on our self-built dataset (covering four abnormal behaviors: Climb, Fall, Fight, Phone) show mAP@50%, precision, and recall reaching 92.2%, 90.75%, and 86.57% respectively-improvements of 3.4%, 4.4%, and 6% over the original model-while maintaining an inference speed of 328.49 FPS. Additionally, generalization testing on the UCSD Ped1 dataset (covering six abnormal behaviors: Biker, Skater, Car, Wheelchair, Lawn, Runner) yielded an mAP score of 92.7%, representing a 1.5% improvement over the original model and outperforming existing mainstream models. Furthermore, the tracking algorithm achieved an MOTA of 90.8% and an MOTP of 92.6%, with a 47.6% reduction in IDS, demonstrating superior tracking performance compared to existing mainstream algorithms.

Abnormal behavior analysis in crowded scenes is a challenging task in the computer vision field. Determining how to quickly and accurately locate abnormal behavior in a crowd, especially in airports, shopping malls, stations, and other practical application scenarios, has become the key to the timely handling of mass incidents. The authors have developed an embedded video analysis robot capable of local processing for crowd anomaly detection in application scenarios. In recent years, many methods of crowd anomaly detection have been proposed by scholars, but the performance of these methods when applied to video service robots is unsatisfactory. In this paper, an anomaly analysis method based on improved k-means is proposed. This method combines mean shift and the k-means classification method to achieve rapid and accurate crowd anomaly detection. A quantitative experimental evaluation was carried out on a video service robot, and the results demonstrate that the method is effective for the detection of abnormal behavior on multiple and publicly available video sequences.

Economic forecasting provides support for governments to formulate rules in advance and ensure the smooth operation of the social economy. At the same time, it is also very important to identify possible network threats in the process of economic forecasting in a timely manner to ensure the security of economic data. In this paper, research is carried out from two aspects of economic forecasting and cyber threat detection. The prediction model MIDAS is constructed to predict the quarterly GDP growth rate with monthly economic data, and the prediction error is reduced by determining the weight function and parameter constraints. Design a behavioral pattern graph that contains normal and abnormal user behaviors. Combine the behavior pattern graph embedding algorithm (GraphSAGE) to achieve graph embedding and graph dimensionality reduction, and introduce Gaussian noise to enhance the effect of cyber threat retrieval.The success rate of GraphSAGE's behavior pattern graph dimensionality reduction reaches up to 97.12%, and 12 cyber threat paths hidden in user behaviors are successfully identified in an average time of 1.82ms-9.18ms.

A method of detecting abnormal electricity consumption behavior of low-voltage electricity consumption users based on weekly electricity consumption is proposed. Firstly, features of weekly electricity consumption curve data are extracted from the actual daily consumption data. Fuzzy C-means clustering algorithm is used to classify electricity consumption behavior. Typical weekly electricity consumption characteristic curves of low-voltage power users are obtained, and then low-voltage users with abnormal electricity consumption are marked based on distance. The effectiveness and feasibility of the algorithm are verified by the actual electricity consumption data of 15 stations in Yang-Zhou City.

Aiming at the problem of internal attackers of database system, anomaly detection method of user behaviour is used to detect the internal attackers of database system. With using Discrete-time Markov Chains (DTMC), an anomaly detection system of user behavior is proposed, which can detect the internal threats of database system. First, we make an analysis on SQL queries, which are user behavior features. Then, we use DTMC model extract behavior features of a normal user and the detected user and make a comparison between them. If the deviation of features is beyond threshold, the detected user behavior is judged as an anomaly behavior. The experiments are used to test the feasibility of the detction system. The experimental results show that this detction system can detect normal and abnormal user behavior precisely and effectively.

Cyber security threats to power systems are constantly evolving, and traditional security protection means are difficult to cope with new and complex attacks. This paper proposes a global situational awareness system for IT terminals based on artificial intelligence, which realizes real-time monitoring and early warning of IT terminals and networks through intelligent analysis and active defense. The system adopts a global data collection method to comprehensively monitor user operational behavior and network traffic through a user behavior data collection tool based on browser plug-ins and a network traffic collection tool based on agent software. To address the issues of user operational behavior deviation and network traffic security, the system introduces a user behavior analysis model based on graph matching algorithm and a network security situational awareness model, which can effectively identify abnormal user behavior and potential risks of the power grid, and significantly improve the system response capability. The system has been applied in the power grid industry and has shown excellent protection effects in the complex and changing network environment.

Preventing unauthorized and illegitimate access to sensitive resources is the primary duty of access control models. However, the malicious activities by authorized users cause significant damages to their underlying systems. In many cases, existing access control models are incomplete in their ability to detect insider abuse, and rather than detecting and preventing insider attack, it seems to still operate by forensic analysis after an attack. Attribute-Based Access Control is a new access control model that can be used instead of other traditional types of access control models, and makes decisions according to the access requests by utilizing users' as well as resources' attributes. However, it still endures a quandary of how to permit the real eligible users to access the resources while blocking abnormal access by authorized users of a system. In this paper, an Attribute/Behavior-Based Access Control is proposed by understanding and deriving users' behaviors from log files. Not only our model uses the user/resource attributes, but it also utilizes their behaviors to detect the abnormal users even with valid attributes. This model principally uses the behaviors of a given user to grant or deny access requests. The concept of a user's behavior will be introduced, and we present a feature construction method to model users' access behaviors. As the proof of concept, machine learning algorithms are trained and tested using a database from UCI Machine Learning Repository. Experimental results illustrate that our model is efficient, accurate, and promising in detecting authorized users with abnormal behaviors.

Analyzing user behavior characteristics in a complex power grid environment is essential for user behavior planning and resource coordination optimization. Traditional user behavior analysis methods based on model-driven and causal analysis have the disadvantages of strong subjectivity and physical models that are difficult to deal with the randomness and uncertainty of user behavior in complex grid environments. In this paper, we use unsupervised learning methods to analyze user behavior in complex power grid environments, and propose user behavior analysis methods based on stacked autoencoder and clustering. We first reduce the complexity of user behavior data by proposing adaptive feature selection algorithm of user behavior based on stacked autoencoder and unsupervised learning (AFS-SAEUL). Finally, we build a user behavior analysis model based on adaptive feature selection and improved clustering (UBA-AFSIC). The model improved the performance of unsupervised classification of user behavior by fusing the adaptive generation strategy of the initial cluster centers. The simulation experiment results on two real electricity datasets and one public electric vehicle charging dataset show that compared with the existing feature selection algorithm and clustering algorithm, the algorithms proposed in this paper have higher feature selection rate and better clustering performance.

In order to solve the problem of insufficient use of sequence information and low detection efficiency of traditional anomaly detection methods, this paper introduces Markov chain into user behaviour sequence detection, and proposes a description based on Markov chain and support vector data field ( SVDD) User Behaviour Sequence Detection Method (ASDMS), which first uses the Markov chain to accurately quantify the user behaviour sequence, then constructs the user’s normal behaviour sequence model based on the support vector data field description model, and identifies the user anomaly behaviour. The experimental results show that the ASDMS method has better performance and timeliness than the traditional abnormal behaviour detection method.