A Lightweight Unsupervised Learning Architecture to Enhance User Behavior Anomaly Detection

Abstract

In recent years, user behavior anomaly detection has been gaining attention in cybersecurity. A crucial challenge that has been discussed in the literature is that supervised models that use vast amounts of data for training do not apply to real scenarios for anomaly detection. Within this context, the requirement to gather datasets with labeled behavior anomalies has proven to be a significant limiting factor for evaluating different models. This paper presents WEAPON, an unsupervised learning-based architecture for user behavior anomaly detection that requires a small amount of data for building behavior profiles considering the individuality of each user. WEAPON implements the weak supervision-based behavior anomaly labeling approach using Snorkel. When compared to other approaches, WEAPON proved to be more efficient, surpassing the ROC curve of the second best model by 4.31%. Furthermore, WEAPON outperforms rule-based methods by finding anomalies that an expert would not anticipate.