Research On User Behavior Analysis And Generative Model In Communication Networks

Communication network is formed by information exchange among people through a variety of modern electronic communication services, such as email network, phonecall network and instant messaging network etc. With the development of information technology and the rapidly increasing popularity of the portable terminals, it becomes the most common methods for the exchange of information. Communication network contains much important information, including social relationships, user behavior patterns(e.g. habits and routines) and activities of individuals. Communication network analysis has been investigated widely and applied in fraud detection, network intrusion detection,services recommendation and so on.This dissertation focuses on mining user behavior patterns, anomaly detection, network modeling and simulation in an intra-company communication network. Mining user behavior patterns is an emerging domain aimed towards determining the people’s routines, institutions structure and dynamics. Detecting anomalies is a vital task for revealing suspicious behavior and spotting rare events. In order to explore the formation and evolution mechanism of the network, a generative model is designed to mimic people’s communication behaviors. The contributions of this thesis are as follows:1. Mining user behavior patterns based on nonnegative matrix factorizationMining user behavior patterns and analyzing its evolution plays an important role in detecting data breaches and insider threats. Firstly, the communication network is divided into two parts: intra-communication network and extra-communication network with missing some links. Then the differences of information integrity between intracommunication network and extra-communication network are analyzed. After that, I extract their structural features and functional features respectively. Based on the basic behavior pattern unit, the traditional binary-relation(features- behavior pattern) is transformed into ternary-relation(features- pattern unit- behavior pattern). And the user behavior patterns are described from the perspective of basic behavior pattern unit. This work could enhance the interpretation and comparability of behavior patterns, and reduce the complexity of analysis. Experimental results on Enron dataset show that this work could describe user behavior patterns more conveniently, and intuitively detect the actual events from the evolution of user behavior patterns.2. An efficient approach for detecting user behavior anomaliesTo tackle the abnormality detection problem, an effective approach is proposed using non-textual features for identifying anomalous behavior in communication networks.Based on an analysis of the user historical behaviors, the benchmark of user behavior is constructed. Then the deviation of behavior is measured for each snapshot. To eliminate the influence of scaling, a transformation process is introduced to map different outlier scores to a normalized score in the range [0,1]. After that, the unified score is provided to indicate the abnormality of user behavior in each snapshot. The experiment on email dataset has demonstrated that outliers can be apparently spotted by the proposed approach. Besides, it can help us to spot significant events from the vast masses of network snapshots.3. Simulation and modeling of communication network based on topic modelUnderstanding how communication networks form and evolve is a crucial research issues in complex network analysis. Various methods are proposed to explore networks generation and evolution mechanism. However, the previous methods usually pay more attention to macroscopic characteristics rather than microscopic characteristics, which may lead to losing much information about individual patterns. Since communication network is associated closely with user behaviors. Thus, the individual patterns should also be taken into consideration in the communication network model. By implicitly labeling each network node with a latent attribute–activity level, an efficient approach is presented for simulation and modeling of communication network based on the topic model. This model is illustrated on a real-world email network obtained from email logs. Experimental results show that the synthetic network preserved some of the global characteristics and individual behavior patterns.