LDA Ensembles for Interactive Exploration and Categorization of Behaviors

Abstract

We define behavior as a set of actions performed by some actor during a period of time. We consider the problem of analyzing a large collection of behaviors by multiple actors, more specifically, identifying typical behaviors and spotting anomalous behaviors. We propose an approach leveraging topic modeling techniques -LDA (Latent Dirichlet Allocation) Ensembles -to represent categories of typical behaviors by topics that are obtained through topic modeling a behavior collection. When such methods are applied to text in natural languages, the quality of the extracted topics are usually judged based on the semantic relatedness of the terms pertinent to the topics. This criterion, however, is not necessarily applicable to topics extracted from non-textual data, such as action sets, since relationships between actions may not be obvious. We have developed a suite of visual and interactive techniques supporting the construction of an appropriate combination of topics based on other criteria, such as distinctiveness and coverage of the behavior set. Two case studies on analyzing operation behaviors in the security management system and visiting behaviors in an amusement park, and the expert evaluation of the first case study demonstrate the effectiveness of our approach.

VASABI: Hierarchical User Profiles for Interactive Visual User Behaviour Analytics

“…The initial sessions are primarily to understand the current working process, make observations and informal interviews where the analysts demoed how they interpret the signals stemming from the UBA model and how they investigate sessions. Observations and findings from these sessions not only informed the designs in this work, but also the recent work produced by the same team [7,30,31]. These papers and our work share the same initial context with an overall user behaviour understanding goal but have different foci and approach.…”

“…The resulting topics are sensitive to a number of parameters: alpha, beta and the number of topics. To tune the parameters for a high quality set of topics, we use a visualisation assisted LDA ensemble technique [7] that guides the interactive selection of the best topics from multiple runs with different parameters. Each topic is modelled as a probability distribution of all words in the vocabulary; for instance, { (SearchUser, 0.6), (DisplayUser, 0.3), (UpdateUserDetails, 0.1) }, and each document is modelled as a probability distribution of all these extracted topics.…”

System Misuse Detection Via Informed Behavior Clustering and Modeling

“…For example, Chandrasekhar and Raghuveer [3] achieved good results by having an expert in the loop. Based on this, we propose to integrate an interactive visual tool [24] for incorporating security experts knowledge about the system. Using a visual interface the experts can separate sequences of interactions to meaningful clusters.…”

“…It is used to indicate how similar topics are. The result of visual analytics is presented in a form of sets of sessions, so it does not provide an inference technique for a new sequence of actions [24]. We have to define a method recognizing the cluster to which the sequence is related the most.…”

“…Exemplary view of the visual interface for the security experts for understanding the distribution of actions and exploring created clusters[24].…”