Behavioural user profiling: Spotting a rogue user before the breach
How behavioural profiling builds a baseline for each user from sessions, page visits and timing, and flags the deviations that mark a compromised account.
By 3 mins readPublished Updated Every company with user accounts has the same problem: some of the people logging in are not who they claim to be. The 2021 Verizon Data Breach Investigations Report (DBIR 2021) counted 79,635 security incidents and 5,258 confirmed breaches, together exposing millions of sensitive records. Breaches are a fact of life, and preventing them deserves the same planning effort as any other service a company runs.
The breach-pattern charts below show social engineering, system intrusion and basic web application attacks as the largest categories among both incidents and breaches. What they share is that each plays out as a sequence of actions over a session or a period of time. In other words, as behaviour.
The same report found that 85% of breaches involved a human element: a person, with habits, behind the attack. Its cost figures add up losses that could have been avoided with a working mechanism to prevent or contain the breach.
Why profile user behaviour
Rule-based detection struggles here. Every website has a different environment and a different set of normal actions, and each new kind of incident needs a new rule, so the rule set grows without ever being complete. One assumption makes the problem tractable: a compromised or rogue user behaves differently from the real one. Record each user's actions over time, compare them with similar users, and you have a baseline. Anything that departs from it is an anomaly worth investigating.
A maintained behaviour profile also moves the defence earlier. Reactive controls act when an incident happens or just after. A profile lets the system act before it: by watching how a user behaves, it can predict exposure to malicious content seconds ahead of the moment it happens, which is the window a preventive defence needs.
What counts as user behaviour
Behaviour is the pattern of actions an actor takes to reach a goal. Depending on the problem, it also includes the environment those actions happen in: time, place, surroundings and the order in which pages were visited.
A machine learning model does not consume raw activity logs. It needs a refined representation of behaviour, derived from the raw record of one user's actions or a batch of them, as the figure below shows.
Turning raw transactional data into a feature space that describes behaviour is called behavioural modelling. It supplies the methods for capturing what a user does and how that changes over time. Once modelled, the behaviour goes to an algorithm, usually a machine learning one, which returns the security decision: is this user rogue or not?
The diagram below shows the whole loop, from behaviour through analysis and modelling to a behaviour-based security decision.
Graph-based user behaviour modelling
Graphs are a common way to model an actor's behaviour. The theory runs deep, but the idea can be understood through a simple state machine, specifically a nondeterministic finite automaton.
A state machine is a graph whose nodes are states and whose edges are transitions between them. Label the edges and you have a behaviour model. In the illustration below, a user's page-visit history has been turned into a profile: each node is a web page, and the probability on each edge is how often that user moves from one page to the next.
With that model in hand, a simple statistical inference tells you how likely a new sequence of page visits is for this user, and so whether it looks abnormal.
Where this leads
Behavioural profiling gives a defence that acts before the breach rather than after it. The entities that make up a user's behaviour, and the baseline built from them, are what let a system isolate a rogue user by how they act, before they get further in.
In practice that means assessing each user's live behaviour against a baseline learned beforehand from the same user and from other legitimate users. That is the approach behind [Sensfrx](/), which scores each signup, login and payment from device, network and behaviour signals in real time.
Credits:
- Verizon for the data.
- behaviorinformatics.org for the diagrams.