Model of corporate information system user behavior

DOI: 10.21293/1818-0442-2023-26-4-78-83

Download article in PDF format

JATS xml

Abstract: A behavior model of corporate user is presented. The model is based on a De Bruijn graph, where the vertices store the fea-tures of text data. The values of textual features are extracted with regard to the data displayed in the client application infor-mation system. The model could be used to identify the behav-ioral anomalies, that could be linked to internal data leaks. The scope of detected behavioral anomalies includes scenarios of the corrupted business process flow and the data leakage of an unusual topic. The model is evaluated by criteria of efficiency, adequacy and completeness.

Keywords: internal data leaks, corporate information systems, behavior model

Funding: The work was carried out within the framework of the “MTUCI IB Grants” 2022 project.

For citation:
Banokin P. I. Model of corporate information system user behavior. Doklady Tomskogo gosudarstvennogo universiteta sistem upravleniya i radioelektroniki, 2023, vol. 26, no. 4, pp. 78–83. DOI: 10.21293/1818-0442-2023-26-4-78-83

Authors and copyright holders:

  • Banokin P. I. , Tomsk State University of Control Systems and Radioelectronics (Tomsk, Russia)

  • 1. Shabtai A., Elovici Y., Rokach L. A survey of data leakage detection and prevention Solutions. Berlin, Germany, Springer, 2012, 92 p., pp. 39-46,
  • 2. Isakova T., Korolev N. Na rabotu kak na fishing. [To go to work as to go fishing]. Newspaper «Kommersant», 08.08.2022, art. 18 (in Russ.).
  • 3. «Rostelekom» oshtrafovali na 60 000 rublei za utechku polzovatelskih dannyh [Rostelecom is fined 60 000 rubles for personal data leakage]. Haker [Hacker]. Available at: https://xakep.ru/2023/04/19/rostelekom-penalty/, free (Accessed: April 19, 2023). (in Russ.).
  • 4. Kurasheva A. Kolichestvo utechek dannyh v krupnih kompaniyah uvelichlos v 1.5 raza [The number of data leaks increased 1.5 times in large corporations]. Vedomosti, 2023, 12.05, article 19 (in Russ.).
  • 5. Printsip raboty Solar Dozor [The principle of Solar Dozor]. Rostelecom. URL: https://rt-solar.ru/products/solar_dozor/architecture/ (Accessed: September 24, 2023) (in Russ.).
  • 6. Evsikov V. Probej menya polnost’yu. Kto, kak I za skolko probivaet personalnie dannie v Rossii [Get my full personal data details! Who, how and for how much does it cost to access personal data in Russia?]. Haker [Hacker], 2020, no. 10. Available at: https://xakep.ru/2020/10/09/personal-data/ (Accessed: September 5, 2023) (in Russ.).
  • 7. Denning D.E. An Intrusion Detection Model. IEEE transactions on software engineering, 1987, vol. SE-13, pp. 222–232.
  • 8. Hu J., Baoming T., Lin D. Anomalous User Activity Detection in Enterprise Multi-Source Logs. International Conference on Data Mining Workshops, New Orleans, USA, IEEE, 2017, pp. 797–803.
  • 9. Mohotti W., Nayak R. Efficient outlier detection in text corpus using rare frequency and ranking. ACM Transactions on Knowledge Discovery from Data, 2020, vol. 14, no. 6, pp. 1–30.
  • 10. Haixuan G., Shuhan Y., Xintao W. LogBERT: Log Anomaly Detection via BERT. International Joint Conference on Neural Networks (IJCNN), Shenzhen, China, IEEE, 2021, pp. 1–8.
  • 11. Weibin M. [et al.] LogAnomaly: Unsupervised Detection of Sequential and Quantitative Anomalies in Unstructured Logs. Proceedings of the Twenty-Eighth International Joint Conference on Artificial Intelligence, Macao, China, IJCAI, 2019, pp. 4739–4745.
  • 12. Modell A., Larson J., Turcotte M., Bertiger A. A Graph Embedding Approach to User Behavior Anomaly Detection. GTA 2.0: The 5th IEEE Big Data Workshop on Graph Techniques for Adversarial Activity Analytics, New Jersey, USA, IEEE, 2021, pp. 2650–2655.
  • 13. Boniol P., Palpanas T. Series2Graph: graph-based subsequence anomaly detection for time series. Proceedings of the VLDB Endowment, Tokyo, Japan, VLDB Endowment, 2020, pp. 1821–1834.
  • 14. Han L., Checco A., Difallah D., Demartini G., Sadiq S. Modelling User Behavior Dynamics with Embeddings. CIKM '20: Proceedings of the 29th ACM International Conference on Information & Knowledge Management, NY, USA, ACM, 2020, pp. 445–454.
  • 15. Bruijn de N.G. A combinatorial problem. Proceedings of the Section of Sciences of the Koninklijke Nederlandse Akademie van Wetenschappen te Amsterdam, 1941, vol. 49, no. 7, pp. 758–764.
  • 16. Pevny T. Loda: Lightweight on-line detector of anomalies. Machine Learning, 2016, vol. 102, pp. 275–304.
  • 17. Chen W., Li H., Li H., Arshad A. Autoencoder-based outlier detection for sparse, high dimensional data. Proceedings of 2020 IEEE International Conference on Big Data (Big Data), Atlanta, USA: IEEE, 2020, pp. 2735–2742.
Editorial office address

Executive Secretary of the Editor’s Office

 Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia

  Phone / Fax: + 7 (3822) 701-582

  journal@tusur.ru

 

Executive Secretary of the Editor’s Office

 Editor’s Office: 40 Lenina Prospect, Tomsk, 634050, Russia

  Phone / Fax: + 7 (3822) 51-21-21 / 51-43-02

Subscription for updates