Analysis of the Behavior of Company Employees as Users of Information Systems or Tools, Based on Employees Clustering with K-means Algorithm

Garkalns, Pavels; Nikiforova, Oksana; Zabiniako, Vitaly; Kornienko, Jurijs

doi:10.1109/itms59786.2023.10317652

Cited by 2 publications

(1 citation statement)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Authors have already implemented the detection of such anomalies in the behavior of IS users in the e-StepControl solution and introduced it for monitoring of user behavior in various business environments [1]- [3]. The idea of this research paper is to expand the existing solution with clustering of users, which essentially involves automatically grouping of IS users with identical or similar behavioral models into separate groups (classes) using Artificial Intelligence and Machine Learning (AI/ML) algorithms.…”

Section: Introductionmentioning

confidence: 99%

Detecting and Identifying Insider Threats Based on Advanced Clustering Methods

Nikiforova,

Romanovs,

Zabiniako

et al. 2024

IEEE Access

Self Cite

View full text Add to dashboard Cite

This paper explores the analysis of user behavior in information systems through audit records, creating a behavior model represented as a graph. The model captures actions over a specified period, facilitating real-time comparison to identify insider threats exploring anomalies detected in behavior models. "e-StepControl," developed by "ABC software" Ltd., incorporates this approach for monitoring user behavior in different business environments. The study proposes enhancing this solution with automatic user clustering, achieved by grouping individuals exhibiting similar behavior patterns using AI/ML algorithms. The research evaluates various clustering methods, discussing their suitability for grouping users based on their behavior. The subsequent step involves leveraging user class behavior models to identify anomalies by comparing an individual's actions with the behavior model expected in their specific user group. This extension aims to enhance the system's ability to detect potentially malicious activities, providing data security administrators with timely alerts in case of deviations from typical behavior.

show abstract

Section: Introductionmentioning

confidence: 99%