Detection of Anomalies Based on User Behavioral Information: A Survey

PDF (579KB), PP.54-65

Views: 0 Downloads: 0

Author(s)

L. Lanuwabang 1,* P. Sarasu 2

1. Kalasalingam Academy of Research and Education, and Director, National Institue of Electronics & Information Technology, Kohima 797001, Nagaland, India

2. Department of CSE, Kalasalingam Academy of Research and Education, Krishnankoil 626126, Tamil Nadu, India

* Corresponding author.

DOI: https://doi.org/10.5815/ijwmt.2025.03.04

Received: 19 Mar. 2024 / Revised: 19 Jun. 2024 / Accepted: 4 Mar. 2025 / Published: 8 Jun. 2025

Index Terms

Anomaly Detection, User Behavior, Deep Learning, Machine Learning, Anomalies

Abstract

User and entity behaviour analytics (UEBA) solutions are becoming more and more popular for detecting anomalies since they establish baseline models of typical user behaviour and highlight deviations from them. Modelling normal user behavior and identifying any new behavior that deviates from the normal model user i.e., an attack, which is the main concept of Anomaly Detection (AD) techniques. In this work, a comprehensive review of various AD techniques based on user behavior is presented. Accordingly, this survey is concerted on various techniques employed for AD based on user behavior.  Among various research articles, 50 research articles based on AD are considered and categorized based on different parameters, like techniques, publication year, performance metrics, utilized tools, and so on.  At last, the research gaps and challenges of this method are illustrated in such a way that a goal for emerging an efficient technique for allowing the effective AD technique is defined.

Cite This Paper

L. Lanuwabang, P. Sarasu, "Detection of Anomalies Based on User Behavioral Information: A Survey", International Journal of Wireless and Microwave Technologies(IJWMT), Vol.15, No.3, pp. 54-65, 2025. DOI:10.5815/ijwmt.2025.03.04

Reference

[1]J. Hu, E. Zhu, S. Wang, X. Liu, X. Guo, and J. Yin, “An efficient and robust unsupervised anomaly detection method using ensemble random projection in surveillance videos,” Sensors, vol.19 no.19, p.4145, 2019.
[2]A. Lukashin, M. Popov, A. Bolshakov, and Y. Nikolashin, “Scalable data processing approach and anomaly detection method for user and entity behavior analytics platform,” In Intelligent Distributed Computing XIII, pp. 344-349, Springer International Publishing, 2020.
[3]C. Schwab, “User and Entity Behavior Analytics for Enterprise Security,” 2016.
[4]X. Xi, T. Zhang, W. Ye, Z. Wen, S. Zhang, D. Du, and Q. Gao, “An ensemble approach for detecting anomalous user behaviors,” Int. J. Softw. Eng. Knowl. Eng, vol.28(11n12), pp.1637-1656, 2018.
[5]S. Wang, Y. Zeng, Q. Liu, C. Zhu, E. Zhu, and J. Yin, “Detecting abnormality without knowing normality: A two-stage approach for unsupervised video abnormal event detection,” In Proceedings of the 26th ACM international conference on Multimedia, pp. 636-644, October 2018.
[6]J. Komulainen, A. Hadid, M. Pietikäinen, A. Anjos, and S. Marcel, “Complementary countermeasures for detecting scenic face spoofing attacks,” In Proceedings of 2013 International conference on biometrics (ICB), pp. 1-7, IEEE, June 2013,
[7]S.R. Arashloo, J. Kittler, and W. Christmas, “An anomaly detection approach to face spoofing detection: A new formulation and evaluation protocol,” IEEE Access, vol.5, pp.13868-13882, 2017.
[8]T. Chen, and C. Guestrin, “Xgboost: A scalable tree boosting system,” In Proceedings of the 22nd acmsigkdd international conference on knowledge discovery and data mining, pp. 785-794, August 2016.
[9]D. Li, D. Chen, B. Jin, L. Shi, J. Goh, and S.K. Ng, “MAD-GAN: Multivariate anomaly detection for time series data with generative adversarial networks,” In Artificial Neural Networks and Machine Learning–ICANN 2019: Text and Time Series: 28th International Conference on Artificial Neural Networks, Munich, Germany, September 17–19, 2019, Proceedings, Part IV (pp. 703-716). Cham: Springer International Publishing, September 2019.
[10]D. Kwon, H. Kim, J. S.C., Kim, Suh, I. Kim, and K.J. Kim, “A survey of deep learning-based network anomaly detection,” Clust. Comput, vol. 22, pp.949-961, 2019.
[11]D.C. Le, and N. Zincir-Heywood, “Anomaly detection for insider threats using unsupervised ensembles,” IEEE Transactions on Network and Service Management, vol.18 no.2, pp.1152-1164, 2021.
[12]T. Wang, M. Qiao, Y. Deng, Y. Zhou, H. Wang, Q. Lyu, and H. Snoussi, “Abnormal event detection based on analysis of movement information of video sequence,” Optik, vol.152, pp.50-60, 2018.
[13]A.R.M. Forkan, I. Khalil, Z. Tari, S. Foufou, and A. Bouras, “A context-aware approach for long-term behavioural change detection and abnormality prediction in ambient assisted living,” Pattern Recognit, vol.48 no.3, pp.628-641, 2015.
[14]M. Yamauchi, Y. Ohsita, M. Murata, K. Ueda, and Y. Kato, “Anomaly detection in smart home operation from user behaviors and home conditions,” IEEE Transactions on Consumer Electronics, vol.66 no.2, pp.183-192, 2020.
[15]P. Kamranfar, D. Lattanzi, A. Shehu, and D. Barbará, “Multiple Instance Learning for Detecting Anomalies over Sequential Real-World Datasets,” arXiv preprint arXiv:2210.01707, 2022.
[16]A.G. Martín, I.M. de Diego, A. Fernández-Isabel, M. Beltrán, and R.R. Fernández, “Combining user behavioural information at the feature level to enhance continuous authentication systems,” Knowledge-Based Syst, vol.244, pp.108544, 2022.
[17]M.S. Parwez, D.B. Rawat, and M. Garuba, “Big data analytics for user-activity analysis and user-anomaly detection in mobile wireless network,” IEEE Transactions on Industrial Informatics, vol.13 no.4, pp.2058-2065, 2017.
[18]F. Skopik, M. Wurzenberger, G. Höld, M. Landauer, and W. Kuhn, “Behavior-Based Anomaly Detection in Log Data of Physical Access Control Systems,” IEEE Transactions on Dependable and Secure Computing, 2022.
[19]Z. Liu, T. Qin, X. Guan, H. Jiang, and C. Wang, “An integrated method for anomaly detection from massive system logs,” IEEE Access, vol.6, pp.30602-30611, 2018
[20]D.J. Hill, and B.S. Minsker, “Anomaly detection in streaming environmental sensor data: A data-driven modeling approach,” Environ. Model. Softw, vol.25 no.9, pp.1014-1022, 2010.
[21]I.I.A. Sulayman, and A. Ouda, “User modeling via anomaly detection techniques for user authentication,” In 2019 IEEE 10th Annual Information Technology, Electronics and Mobile Communication Conference (IEMCON), pp. 0169-0176, IEEE, October 2019.
[22]B. Böse, B. Avasarala, S. Tirthapura, Y.Y. Chung, and D. Steiner, “Detecting insider threats using radish: A system for real-time anomaly detection in heterogeneous data streams,” IEEE Systems Journal, vol.11 no.2, pp.471-482, 2017.
[23]J. Cui, G. Zhang, Z. Chen, and N. Yu, “Multi-homed abnormal behavior detection algorithm based on fuzzy particle swarm cluster in user and entity behavior analytics,” Sci. Rep, vol.12 no.1, p.22349, 2022.
[24]G. Fernandes Jr, L.F. Carvalho, J.J.  Rodrigues, and M.L. Proença Jr, “Network anomaly detection using IP flows with principal component analysis and ant colony optimization,” J Netw Comput Appl, vol.64, pp.1-11, 2016.
[25]J. Hu, E. Zhu, S. Wang, S. Wang, X. Liu, and J. Yin, “Two-stage unsupervised video anomaly detection using low-rank based unsupervised one-class learning with ridge regression,” In Proceedings of 2019 International Joint Conference on Neural Networks (IJCNN), pp. 1-8, IEEE, July 2019.
[26]A.G. Martín, M. Beltrán, A. Fernández-Isabel, and I.M. de Diego, “An approach to detect user behaviour anomalies within identity federations,” Comput. Secur, vol.108, pp.102356, 2021.
[27]K.W. Cheng, Y.T. Chen, and W.H. Fang, “An efficient subsequence search for video anomaly detection and localization,” Multimed. Tools Appl, vol.75, pp.15101-15122, 2016.
[28]L. Feremans, V. Vercruyssen, B. Cule, W. Meert, and B. Goethals, “Pattern-based anomaly detection in mixed-type time series,” In Machine Learning and Knowledge Discovery in Databases: European Conference, ECML PKDD 2019, Würzburg, Germany, September 16–20, 2019, Proceedings, Part I (pp. 240-256). Springer International Publishing, 2020.
[29]M. Tahir, M. Li, X. Zheng, A. Carie, J. Xing, M. Azhar, N. Ayoub, A. Wagan, M. Aamir, L.A. Jamali, and M.A. Imran, “A novel network user behaviors and profile testing based on anomaly detection techniques,” Int J Adv Comput Sc, vol.10, no.6, 2019. 
[30]S. Lee, H.G. Kim, and Y.M. Ro, “Bman: Bidirectional multi-scale aggregation networks for abnormal event detection,” IEEE Transactions on Image Processing, vol.29, pp.2395-2408, 2019.
[31]W. Chen, Y. Zhang, C.K. Yeo, C.T. Lau, and B.S. Lee, “Unsupervised rumor detection based on users’ behaviors using neural networks,” Pattern Recognit. Lett, vol. 105, pp.226-233, 2018.
[32]T. Li, X. Chen, F. Zhu, Z. Zhang, and H. Yan, “Two-stream deep spatial-temporal auto-encoder for surveillance video abnormal event detection,” Neurocomputing, vol. 439, pp.256-270, 2021.
[33]S. Lin, R. Clark, R. Birke, S. Schönborn, N.  Trigoni, and S. Roberts, “Anomaly detection for time series using vae-lstm hybrid model,” In ICASSP 2020-2020 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4322-4326, May, 2020.
[34]S. Yan, J.S. Smith, W. Lu, and B. Zhang, “Abnormal event detection from videos using a two-stream recurrent variational autoencoder,” IEEE Transactions on Cognitive and Developmental Systems, vol.12 no.1, pp.30-42, 2018.
[35]J. Henriques, F. Caldeira, T. Cruz, and P. Simões, “Combining k-means and xgboost models for anomaly detection using log datasets,” Electronics, vol.9 no.7, p.1164, 2020.
[36]A. Garg, W. Zhang, J. Samaran, R. Savitha, and C.S. Foo, “An evaluation of anomaly detection and diagnosis in multivariate time series,” IEEE Transactions on Neural Networks and Learning Systems, vol.33 no.6, pp.2508-2517, 2021.
[37]H. Zhang, and Z. Li, “Anomaly detection approach for urban sensing based on credibility and time-series analysis optimization model,” IEEE Access, vol.7, pp.49102-49110, 2019.
[38]W. Ullah, A. Ullah, I.U. Haq, K. Muhammad, M. Sajjad, and S.W. Baik, “CNN features with bi-directional LSTM for real-time anomaly detection in surveillance networks,” Multimed. Tools Appl, vol.80, pp.16979-16995, 2021.
[39]N. Li, and F. Chang, “Video anomaly detection and localization via multivariate gaussian fully convolution adversarial autoencoder,” Neurocomputing, vol.369, pp.92-105, 2019.
[40]L. Feremans, V. Vercruyssen, W. Meert, B. Cule, and B. Goethals, “A framework for pattern mining and anomaly detection in multi-dimensional time series and event logs,” In New Frontiers in Mining Complex Patterns: 8th International Workshop, NFMCP 2019, Held in Conjunction with ECML-PKDD 2019, Würzburg, Germany, September 16, 2019, Revised Selected Papers 8, pp. 3-20, Springer International Publishing, 2020.
[41]F. Jiang, J. Yuan, S.A. Tsaftaris, and A.K. Katsaggelos, “Anomalous video event detection using spatiotemporal context,” Com. Vis. Ima Unders, vol.115 no.3, pp.323-333, 2011.
[42]Q. Fu, J.G. Lou, Y. Wang, and J. Li, “Execution anomaly detection in distributed systems through unstructured log analysis,” In Proceedings of 2009 ninth IEEE international conference on data mining, pp. 149-158, IEEE, December 2009.
[43]I. Friedberg, F. Skopik, G.  Settanni, and R. Fiedler, “Combating advanced persistent threats: From network event correlation to incident detection,” Comput. Secur, vol.48, pp.35-57, 2015.
[44]H.K. Kim, K.H. Im, and S.C. Park, “DSS for computer security incident response applying CBR and collaborative response,” Expert Syst. Appl, vol.37 no.1, pp.852-870, 2010.
[45]Z. Lijun, H. Guiqiu, L. Qingsheng, and D. Guanhua, “An intuitionistic calculus to complex abnormal event recognition on data streams,” Secur Commun Netw, pp.1-14, 2021.
[46]P. Radoglou-Grammatikis, P. Sarigiannidis, E. Iturbe, E. Rios, S. Martinez, A. Sarigiannidis, G. Eftathopoulos, Y. Spyridis, A. Sesis, N. Vakakis, and D. Tzovaras, “Spear siem: A security information and event management system for the smart grid,” Com. Net, vol.193, pp.108008., 2021. 
[47]M. Saebi, J. Xu, L.M. Kaplan, B. Ribeiro, and N.V. Chawla, “Efficient modeling of higher-order dependencies in networks: from algorithm to application for anomaly detection,” EPJ Data Sci, vol.9 no.1, p.15, 2020.
[48]Y.S. Chong, and Y.H. Tay, “Abnormal event detection in videos using spatiotemporal autoencoder,” In Advances in Neural Networks-ISNN 2017: 14th International Symposium, ISNN 2017, Sapporo, Hakodate, and Muroran, Hokkaido, Japan, June 21–26, 2017, Proceedings, Part II 14, pp. 189-196, Springer International Publishing, 2017.
[49]R.V.H.M. Colque, C. Caetano, M.T.L. de Andrade, and W.R. Schwartz, “Histograms of optical flow orientation and magnitude and entropy to detect anomalous events in videos”, IEEE Transactions on Circuits and Systems for Video Technology, vol.27 no.3, pp.673-682, 2016.
[50]L.J. Chen, Y.H. Ho, H.H. Hsieh, S.T. Huang, H.C.  Lee, and S. Mahajan, “ADF: An anomaly detection framework for large-scale PM2. 5 sensing systems,” IEEE Internet of Things Journal, vol.5 no.2, pp.559-570, 2017.
[51]S. Ahmad, A. Lavin, S. Purdy, and Z. Agha, “Unsupervised real-time anomaly detection for streaming data,” Neurocomputing, vol. 262, pp.134-147, 2017.
[52]N. Cao, C. Shi, S. Lin, J. Lu, Y.R. Lin, and C.Y. Lin, “Targetvue: Visual analysis of anomalous user behaviors in online communication systems,” IEEE Transactions on Visualization and computer graphics, vol.22, no.1, pp.280-289, 2015.
[53]X. Xi, T. Zhang, D. Du, G. Zhao, Q. Gao, W. Zhao, and S. Zhang, “Method and System for Detecting Anomalous User Behaviors: An Ensemble Approach,” In SEKE, pp. 263-262, 2018.
[54]T. Laue, T. Klecker, C. Kleiner, and K.O. Detken, “A SIEM Architecture for Advanced Anomaly Detection,” Open Journal of Big Data, vol.6 no.1, pp.26-42, 2022.
[55]V. Muliukha, A. Lukashin, L.V. Utkin, M. Popov, and A.A. Meldo, “Anomaly Detection Approach in Cyber Security for User and Entity Behavior Analytics System,” In ESANN, pp. 251-256, October 2020.