User behavior anomaly detection

1. A network user behavior system that detects anomalous user behavior comprising:

a memory system comprising a user behavior module, the user behavior module configured to:

create a user profile based on user activity, the user profile comprising user activity logs that record parameters related to user activity;

identify & choose indicator features, wherein the indicator feature includes user activity related to the parameters;

create a single and unique user identifier (UID) for each combination of the indicator feature and user;

associate each UID with a timestamp to establish a UID and timestamp relationship;

establish a UID and timestamp relationship range indicative of non-anomalous user behavior; and

identify an anomalous user behavior as a UID and timestamp relationship outside of the range indicative of non-anomalous user behavior.

2. The network user behavior system user behavior module of claim 1 , wherein the UID and timestamp relationship includes an occurrence count of a timestamp over a determined period of time.

3. The network user behavior system of claim 2 , wherein the parameters are selected from the group consisting of user name, source IP address, destination IP address, process name, source hostname, destination hostname, email ID, user action, event type, user-agent, referrer, requested URL, requested domain, file path, file type, traffic direction, protocol, destination port, TCP flags, user location, user access time, user access duration, user application interaction, user data type downloaded, and user data amount downloaded.

4. The network user behavior system of claim 2 , wherein upon detection of an anomalous user behavior, the system blocks further user activity.

5. The network user behavior system of claim 2 , wherein upon detection of an anomalous user behavior, the system prevents user access to files.

6. The network user behavior system of claim 1 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior includes user activity that is concentrated in a time period.

7. The network user behavior system of claim 1 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior includes user activity that is constant throughout a time period.

8. The network user behavior system of claim 1 , wherein the identification of user anomalous behavior comprises the use of parametric testing.

9. The network user behavior system of claim 1 , wherein the identification of user anomalous behavior comprises the use of nonparametric testing.

10. The network user behavior system of claim 1 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior is established by steps comprising:

identifying an interval threshold (Ith) based on the type of user activity;

identifying a first occurrence of the UID and the UID time stamp as T0;

wherein with T0 as a starting time, identifying the time stamp of a last feature observed for the UID in a time interval T0+Ith (T1);

establishing T1 as a starting time to identify a time stamp of the last occurrence of the UID in the interval T1+Ith (T2);

performing the establishing step recursively until the system identifies a time stamp Tn such that there are no more events found for the UID in the time interval Tn+Ith; and

identifying time boundary values, with a starting value being T0-Ith and an ending time value being Tn+Ith;

wherein events observed outside the time boundary value are anomalous.

11. A method for detecting anomalous user behavior on a network comprising:

creating a user profile based on user activity, the user profile comprising user activity logs that record parameters related to user activity;

identifying and choosing indicator features, wherein the indicator feature includes user activity related to the parameters;

creating a single and unique user identifier (UID) for each combination of the indicator feature and user;

associating each UID with a timestamp to establish a UID and timestamp relationship;

establishing a UID and timestamp relationship range indicative of non-anomalous user behavior; and

identifying an anomalous user behavior as a UID and timestamp relationship outside of the range indicative of non-anomalous user behavior.

12. The method of claim 11 , wherein the UID and timestamp relationship includes an occurrence count of a timestamp over a determined period of time.

13. The method of claim 12 , wherein the parameters are selected from the group consisting of user name, source IP address, destination IP address, process name, source hostname, destination hostname, email ID, user action, event type, user-agent, referrer, requested URL, requested domain, file path, file type, traffic direction, protocol, destination port, TCP flags, user location, user access time, user access duration, user application interaction, user data type downloaded, and user data amount downloaded.

14. The method of claim 12 , wherein upon detection of an anomalous user behavior, the method blocks further user activity.

15. The method of claim 12 , wherein upon detection of an anomalous user behavior, the method prevents user access to files.

16. The method of claim 11 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior includes user activity that is concentrated in a time period.

17. The method of claim 11 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior includes user activity that is constant throughout a time period.

18. The method of claim 11 , wherein the identification of user anomalous behavior comprises the use of parametric testing.

19. The method of claim 11 , wherein the identification of user anomalous behavior comprises the use of nonparametric testing.

20. The method of claim 11 , wherein the UID and timestamp relationship range indicative of non-anomalous user behavior is established by steps comprising:

identifying an interval threshold (Ith) based on the type of user activity;

identifying a first occurrence of the UID and the UID time stamp as T0;

wherein with T0 as a starting time, identifying the time stamp of a last feature observed for the UID in a time interval T0+Ith (T1);

establishing T1 as a starting time to identify a time stamp of the last occurrence of the UID in the interval T1+Ith (T2);

performing the establishing step recursively until the system identifies a time stamp Tn such that there are no more events found for the UID in the time interval Tn+Ith; and

identifying time boundary values, with a starting value being T0-Ith and an ending time value being Tn+Ith;

wherein events observed outside the time boundary value are anomalous.