Contextual Sequence-Based User Behavior Anomaly Detection

doi:10.1109/ACCESS.2025.3543500

Contextual Sequence-Based User Behavior Anomaly Detection

2025-01-01

0

OA

AI

DOI：10.1109/ACCESS.2025.3543500

Original

Original request for help

Save

Abstract

En 中文

Given a series of user action sequences, Contextual Sequence-Based User Behavior Anomaly Detection (CS-UBAD) identifies anomalous sequences that deviate from normal behavior patterns. The CS-UBAD problem is important for detecting insider threats, such as unauthorized access, intellectual property theft, or other malicious activities within an organization's systems. In this paper, we propose a novel approach called Contiguous, Contextual, and Classifying Pipeline (C3P), which integrates pattern mining and the ABC (Antecedent-Behavior-Consequence) model to calculate anomaly scores without requiring human intervention. Our method reduces the computational complexity while accurately detecting anomalous sequences.

Keywords:

Anomaly detection

Hidden Markov models

Context modeling

Analytical models

Probabilistic logic

Databases

Pipelines

Focusing

Data models

Scalability

User behavior analytics

context awareness

local context weighting

contiguous pattern mining

anomaly detection

Kullback Leibler divergence

n-grams

probability distribution

maximum patterns

performance metrics

Contextual Sequence-Based User Behavior Anomaly Detection

Abstract

Journal

Organization