User Profiling on Universal Data Insights tool on IBM Cloud Pak for Security

Abstract

User profiling is one of the most important research topics where organizations endeavour to establish profiles of user activities to detect or predict potential abnormal behaviours. Previous researches have mainly focused on detecting and identifying static activities through social media. A universal analysis based on streaming settings to monitor user activities continuously is missing. This paper proposes a framework for user profiling based on UDI platforms to address this issue. Our framework consists of three main steps: simulating realistic scenarios for user activities, proposing and extracting potential features, and applying machine learning models on simulated datasets. Our experimental results show that selected machine learning algorithms can distinguish most abnormal behaviours correctly. LODA, RRCF, and LSCP algorithms achieve the highest performance among all algorithms. Tree-based algorithms such as Isolation Forest acquire the best results when considering small datasets and speed. Furthermore, machine learning algorithms’ performance demonstrates the high quality of our simulated datasets.