Detection of Anomaly User Behaviors Based on Deep Neural Networks

In order to predict the user's anomaly operation behaviors, we perform deep learning modeling on the user's UNIX command line operation sequence. The use of deep neural networks in anomaly detection is to build a model through the training set, enabling the model to predict the user's next action or command based on the given first $n$ actions or commands. The network trains the command set commonly used by users. After a period, the network can match the real commands according to the existing user characteristic files in the network, and any mismatched events or commands are regarded as anomalies. The detection of anomaly user behaviors is an imbalanced classification problem. To address imbalanced classification problem, we propose an imbalanced self-paced sampling method to improve the efficiency of anomaly user behavior detection. The results show that the DNNs model can usually find anomaly user behaviors that are not easily detectable by other models in anomaly detection.