User Behaviour Anomaly Detection in Multidimensional Data

User Anomaly Detection, an important aspect of User Behaviour Analysis, is used to find anomalous user events from the event and network traffic log data. Traditional security mechanisms are not able to detect new/unknown types of anomalies as they do not incorporate contextual and behavioural aspects of the data for analysis. User Behaviour Anomaly Detection (UBAD) employs user behavioural patterns in context thereby achieving a higher detection rate. Log data employed for UBAD has multiple dimensions. With increase in dimensions (attributes), data gets sparse and the detection of anomalies becomes increasingly complex. For this reason, the single dimensional algorithms proposed for anomaly detection based on clustering, proximity and dimensional reduction do not work well on higher dimension data. OLAP based data analysis techniques provide efficient data slicing and aggregation operations crucial for multidimensional analytics along with multiscale visualisation for exploratory discovery. In this paper, an effective multidimensional process for UBAD is developed to detect anomalies using multi-dimensional statistical tests. An integral part of the process is the development of an OLAP Cube data model for event log data. The statistical efficiency of the UBAD process for different dimensions is investigated. On a real-life event log data, it is shown that the statistical efficiency of detection improves with the increased dimensionality of the tests: the true negative rate and the true positive rate show marked improvement. It is deduced that the computationally more expensive higher dimensional tests need to be employed in order to achieve better anomaly detection.