Online anomaly detection on e-commerce based on variable-length behavior sequence

User behavior-based anomaly detection is currently one of the major concerns of system security research. For ecommerce, this paper proposes an online anomaly detection method, based on variable-length sequences of user behavior. The algorithm includes a training stage and a detection stage. In the training stage, we mainly use the variable-length sequences to represent the correlation between the contiguous operations, and also the correlation between the related items. It makes the representation ability of our model stronger. In the detection stage, in consideration of the legitimate user's behavior patterns likely having a deviation from normal behavior patterns and the illegitimate user's behavior patterns likely being consistent with normal behavior patterns in short time, we use a windowed smooth approach to avoid such problems affecting the result when the decision value is calculated. Meanwhile, we calculate the IDF-value of every pattern in the normal user behavior pattern database, and then the pattern whose IDF-value is below the threshold would be ignored in the detection stage (The lower the IDF-value, the lower the degree of recognition). Experimental results show that our algorithm can detect anomaly in real time effectively, and could meet the needs of real-time process both in accuracy and speed.