Devising an approach to the identification of system users by their behavior using machine learning methods

Abstract

One of the biggest reasons that lead to violations of the security of companies’ services is obtaining access by the intruder to the legitimate accounts of users in the system. It is almost impossible to fight this since the intruder is authorized as a legitimate user, which makes intrusion detection systems ineffective. Thus, the task to devise methods and means of protection (intrusion detection) that would make it possible to identify system users by their behavior becomes relevant. This will in no way protect against the theft of the data of the accounts of users of the system but will make it possible to counteract the intruders in cases where they use this account for further hacking of the system. The object of this study is the process of protecting system users in the case of theft of their authentication data. The subject is the process of identifying users of the system by their behavior in the system. This paper reports a functional model of the process of ensuring the identification of users by their behavior in the system, which makes it possible to build additional means of protecting system users in the case of theft of their authentication data. The identification model takes into consideration the statistical parameters of user behavior that were obtained during the session. In contrast to the existing approaches, the proposed model makes it possible to provide a comprehensive approach to the analysis of the behavior of users both during their work (in a real-time mode) and after the session is over (in a delayed mode). An experimental study on the proposed approach of identifying users by their behavior in the system showed that the built patterns of user behavior using machine learning methods demonstrated an assessment of the quality of identification exceeding 0.95.