Detecting Anomalous User Behavior Using Generative Models of User Actions

Abstract

An apparatus for detecting abnormal behavior of users is disclosed. The apparatus identifies from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users. The apparatus also identifies from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity. The apparatus calculates an amount of deviation between the first number of actions and the second number of actions. The deviation identifies a difference between amounts of time spent in the one or more roles. The apparatus then determines whether the amount of deviation between the first number of actions and the second number of actions exceeds a threshold for abnormal behavior.

What is claimed is: 
     
         1 . An apparatus for detecting abnormal behavior of users, the apparatus comprising:
 one or more processor units and one or more memories;   first program code to identify from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users;   second program code to identify from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity;   third program code to calculate an amount of deviation between the first number of actions and the second number of actions, wherein the deviation identifies a difference between amounts of time spent in the one or more roles; and   fourth program code to determine whether the amount of deviation between the first number of actions and the second number of actions exceeds a threshold for abnormal behavior, wherein the first, second, third, and fourth program code are stored in at least one of the one or more memories for execution by at least one of the one or more processor units via at least one of the one or more memories.   
     
     
         2 . The apparatus of  claim 1 , wherein the one or more roles of the users is generated from the log of user activity based on actions of the users over a period of time selected for determining the roles of the users. 
     
     
         3 . The apparatus of  claim 1 , wherein one or more actions in the first number of actions and the second number of actions is performed on one or more resources, and wherein the one or more roles is identified in part by which resources the one or more actions are performed on. 
     
     
         4 . The apparatus of  claim 1 , wherein the threshold for abnormal behavior is one of a threshold for abnormal behavior of the user, a threshold for abnormal behavior of the user in the one or more roles, a threshold for abnormal behavior of the users, and a threshold for abnormal behavior of the users in the one or more roles. 
     
     
         5 . The apparatus of  claim 1 , wherein the pattern of user activity is a first pattern, the amount of deviation is a first deviation, and further comprising:
 fifth program code to identify from the log of user activity, a third number of actions performed by the user over the first time period that match a second pattern of user activity;   sixth program code to identify from the log of user activity, a fourth number of actions performed by the user over the second time period that match the second pattern of user activity;   seventh program code to calculate a second amount of deviation between the first and third number of actions and the second and fourth number of actions, wherein the second amount of deviation is a difference between time spent by the user in roles in the first time period and the second time period; and   eighth program code to determine whether the second amount of deviation exceeds the threshold for abnormal behavior, wherein the fifth, sixth, seventh, and eighth program code are stored in at least one of the one or more memories for execution by at least one of the one or more processor units via at least one of the one or more memories.   
     
     
         6 . A computer program product for detecting abnormal behavior of users, the computer program product comprising program instructions stored on a computer readable storage device, for:
 identifying from a log of user activity, a first number of actions performed by a user over a first time period that match a pattern of user activity for a task associated with one or more roles of the users;   identifying from the log of user activity, a second number of actions performed by the user over a second time period that match the pattern of user activity;   calculating an amount of deviation between the first number of actions and the second number of actions, wherein the deviation identifies a difference between amounts of time spent in the one or more roles; and   determining whether the amount of deviation between the first number of actions and the second number of actions exceeds a threshold for abnormal behavior.   
     
     
         7 . The computer program product of  claim 6 , wherein the one or more roles of the users is generated from the log of user activity based on actions of the users over a period of time selected for determining the roles of the users.