Quantitative criteria for recognizing the incorrect behavior of computer network users

Abstract

Two approaches for recognizing the incorrect behavior of computer network users are presented. The first one relies on the technique of statistical hypotheses testing and uses self-organizing feature maps (Kohonen networks) for generating target statistics. The second approach recognizes dangerous activity using executed sequences of relevant typical actions, with their dynamics being represented with the aid of Markov chains.