Detecting user behavior anomalies in communication networks

Mining user behavior and analyzing its anomalies are crucial research issues in detecting data breaches and insider threats. In this paper, we propose an effective approach using non-textual features for identifying anomalous behaviors in communication networks. Based on user historic behaviors, we construct the benchmark of behaviors and then measure the deviates of behavior in each snapshot. Finally, we introduce a transform process to derive a comparable normalized score as the indicator of user behavior abnormality in each snapshot. The experiment on email dataset has demonstrated that our approach is easily interpretable. Besides, it can be used to spot significant events from vast masses of network snapshots.