Automatic generation of training data for anomaly detection using other user's data samples
A method of forming an anomaly detection monitor includes obtaining data samples of operations performed on an application by a plurality of users and detecting, by a processor, anomalous behavior associated with a target user of the plurality of users with respect to the application based on a portion of the data samples associated with the target user and a portion of the data samples associated with a second user of the plurality of users, different from the target user.
1 . A method of forming an anomaly detection monitor comprising:
obtaining data samples of operations performed on an application by a plurality of users; and
detecting, by a processor, anomalous behavior associated with a target user of the plurality of users with respect to the application based on a portion of the data samples associated with the target user and a portion of the data samples associated with a second user of the plurality of users, different from the target user, wherein the second user of the plurality of users is selected based on determining a distance relationship between the portion of the data samples associated with the second user and the portion of the data samples associated with the target user,
wherein determining the distance relationship comprises determining that the portion of the data samples associated with the second user are either among a subset of the data samples residing in regions of relatively low data density or among a subset of the data samples residing in regions of relatively high data density, as determined in relation to the portion of the data samples associated with the target user.
2 . The method of claim 1 , further comprising:
generating a normal sample data set based on the portion of the data samples associated with the target user;
generating an abnormal sample data set based on the portion of the data samples associated with the second user; and
training a classifier based on the normal sample data set and the abnormal sample data set,
wherein detecting the anomalous behavior associated with the target user is performed based on the classifier.
3 . The method of claim 2 , wherein generating the abnormal sample data set based on the portion of the data samples associated with the second user comprises deriving samples from low density areas of the portion of the data samples associated with the second user relative to the portion of the data samples associated with the target user using a Local Outlier Factor (LOF) function.
4 . The method of claim 2 , wherein the classifier is a machine-learning based classifier.
5 . The method of claim 1 , wherein detecting, by the processor, the anomalous behavior associated with the target user with respect to the application comprises generating a normal sample data set by executing a Local Outlier Factor (LOF) on the portion of the data samples associated with the target user to identify and remove outlier samples from the portion of the data samples associated with the target user.
6 . A system comprising:
a memory; and
a processor, operatively coupled to the memory, to:
obtain data samples of operations performed on an application by a plurality of users; and
detect, by the processor, anomalous behavior associated with a target user of the plurality of users with respect to the application based on a portion of the data samples associated with the target user and a portion of the data samples associated with a second user of the plurality of users, different from the target user, wherein the second user of the plurality of users is selected based on determining a distance relationship between the portion of the data samples associated with the second user and the portion of the data samples associated with the target user
wherein determining the distance relationship comprises determining that the portion of the data samples associated with the second user are either among a subset of the data samples residing in regions of relatively low data density or among a subset of the data samples residing in regions of relatively high data density, as determined in relation to the portion of the data samples associated with the target user.
7 . The system of claim 6 , further comprising:
generate a normal sample data set based on the portion of the data samples associated with the target user;
generate an abnormal sample data set based on the portion of the data samples associated with the second user; and
train a classifier based on the normal sample data set and the abnormal sample data set,
wherein detecting the anomalous behavior associated with the target user is performed based on the classifier.
8 . The system of claim 7 , wherein to generate the abnormal sample data set based on the portion of the data samples associated with the second user the processor is to derive samples from low density areas of the portion of the data samples associated with the second user relative to the portion of the data samples associated with the target user using a Local Outlier Factor (LOF) function.
9 . The system of claim 7 , wherein the classifier is a machine-learning based classifier.
10 . The system of claim 6 , wherein to detect the anomalous behavior associated with the target user with respect to the application the processor is to generate a normal sample data set by executing a Local Outlier Factor (LOF) on the portion of the data samples associated with the target user to identify and remove outlier samples from the portion of the data samples associated with the target user.
11 . A non-transitory computer-readable storage medium including instructions that, when executed by a processor, cause the processor to:
obtain data samples of operations performed on an application by a plurality of users; and
detect, by the processor, anomalous behavior associated with a target user of the plurality of users with respect to the application based on a portion of the data samples associated with the target user and a portion of the data samples associated with a second user of the plurality of users, different from the target user, wherein the second user of the plurality of users is selected based on determining a distance relationship between the portion of the data samples associated with the second user and the portion of the data samples associated with the target user
wherein determining the distance relationship comprises determining that the portion of the data samples associated with the second user are either among a subset of the data samples residing in regions of relatively low data density or among a subset of the data samples residing in regions of relatively high data density, as determined in relation to the portion of the data samples associated with the target user.
12 . The non-transitory computer-readable storage medium of claim 11 , further comprising:
generate a normal sample data set based on the portion of the data samples associated with the target user;
generate an abnormal sample data set based on the portion of the data samples associated with the second user; and
train a classifier based on the normal sample data set and the abnormal sample data set,
wherein detecting the anomalous behavior associated with the target user is performed based on the classifier.
13 . The non-transitory computer-readable storage medium of claim 12 , wherein to generate the abnormal sample data set based on the portion of the data samples associated with the second user the processor is to derive samples from low density areas of the portion of the data samples associated with the second user relative to the portion of the data samples associated with the target user using a Local Outlier Factor (LOF) function.
14 . The non-transitory computer-readable storage medium of claim 11 , wherein to detect the anomalous behavior associated with the target user with respect to the application the processor is to generate a normal sample data set by executing a Local Outlier Factor (LOF) on the portion of the data samples associated with the target user to identify and remove outlier samples from the portion of the data samples associated with the target user.