Praćenje i analiza ponašanja korisnika

master's thesis

• Title (english): User behavior monitoring and analysis
• Author: Fran Čutura
• Mentor: Marin Golub (mentor)
• Committee member: Marin Golub (predsjednik povjerenstva)
• Committee member: Domagoj Jakobović (član povjerenstva)
• Committee member: Stjepan Groš (član povjerenstva)
• Granter: University of Zagreb; Faculty of Electrical Engineering and Computing; Zagreb
• Defense date and country: 2023-07-06, Croatia

Abstract

Ovaj diplomski rad nudi sveobuhvatan pristup otkrivanju unutarnjih prijetnji analizom ponašanja korisnika s pomoću tehnika strojnog učenja. Primarni je fokus na razvoju prediktivnih modela za otkrivanje prijetnji. U radu su primijenjena dva modela: "izolacijska šuma", jednostavan, ali učinkovit algoritam učenja bez nadzora, i složenija mreža dugoga kratkoročnog pamćenja (LSTM), vrsta rekurentne neuronske mreže poznata po svojoj učinkovitosti u rukovanju sekvencijalnim podatcima. Modeli su uvježbani i testirani na slobodno dostupnom skupu podataka. Rezultati upućuju na bolju izvedbu LSTM-a u točnom prepoznavanju nenormalnog ponašanja. Unatoč relativno zadovoljavajućoj izvedbi modela Isolation forest, LSTM ga je nadmašio, uglavnom zbog svoje sposobnosti da razumije vremensku prirodu ponašanja korisnika, što je ključan aspekt u analizi ponašanja korisnika. Ovaj rad pruža uvid u primjenjivost metoda strojnog učenja i dubokog učenja u analizi ponašanja korisnika i u otkrivanju unutarnjih prijetnji. Nalazi naglašavaju potencijal spomenutih tehnika u poboljšanju mjera kibernetičke sigurnosti organizacija.

Abstract (english)

This thesis presents a comprehensive approach to detecting insider threats by analyzing user behavior using machine learning techniques. The primary focus is on developing predictive models for threat detection. Two models were used in this work: Isolation forest, a simple but effective unsupervised learning algorithm, and a more complex long-short-term memory (LSTM) network, a type of recurrent neural network known for its efficiency in handling sequential data. The models were trained and tested on a freely available data set. The results indicate a better performance of LSTM in the accurate recognition of abnormal behavior. Despite the relatively satisfactory performance of the Isolation Forest model, LSTM outperformed it, mainly due to LSTM's ability to understand the temporal nature of user behavior, which is a key aspect in user behavior analysis. This paper provides insight into the applicability of machine learning and deep learning methods in analyzing user behavior and detecting insider threats. The findings highlight the potential of these techniques to improve organizations' cybersecurity measures.

• Keywords: Analiza ponašanja korisnika; otkrivanje unutarnjih prijetnji; strojno učenje; otkrivanje anomalija; kibernetička sigurnost
• Keywords (english): User Behavior Analysis; Insider Threat Detection; Machine Learning; Anomaly Detection; Cybersecurity
• Language: croatian
• URN:NBN: urn:nbn:hr:168:909218
• Study programme: Title: Computing; Study programme type: university; Study level: graduate; Academic / professional title: magistar/magistra inženjer/inženjerka računarstva (magistar/magistra inženjer/inženjerka računarstva)
• Type of resource: Text
• File origin: Born digital
• Access conditions: Closed access
• Created on: 2023-10-11 08:40:01