# Multi-Granularity User Anomalous Behavior Detection
## 5 Experiments
### Anomaly Detection on Different Behavior Data Ratios
#### 5.3.2 Results on User Level (FAD)  
In user-level anomaly detection, we focused specifically on the detection performance of MG-UABD for 70 anomalous users. Initially, we randomly selected four anomalous users and observed the impact of using different proportions of the training set on the detection performance for each user. As can be seen from Figure 5 and Table 7, the effect of the training set proportion varies among different users. For users TNM0961, CQW0652, and FSC0601, the detection performance generally improves as the training set increases, although there is a slight increase in the FPR for user CQW0652. User IJM0776 shows a pattern where the detection performance initially improves and then declines, reaching its best performance when the training data comprise 60% of the dataset. The unusual trends in the metric values may be due to overfitting by the model to these specific users' behavior patterns, where an increase in training data actually hinders the model's anomaly detection capabilities.  
Generally, for most users, more training data lead to better anomaly detection performance; however, this rule does not apply uniformly across all users with certain behavior patterns. There was no clear correlation found between the variations in anomaly detection performance and the sample size for different users. This suggests that different users have distinct behavior patterns and varying distributions of normal and anomalous behavior samples, leading to the conclusion that the optimal setting for the amount of training data varies and needs to be customized based on the actual circumstances and requirements of each user.  
\begin{table}
\begin{tabular}{l c c c c c} \hline \hline
**User ID** & **PRE (\%)** & **DTR (\%)** & **F1 (\%)** & **ACC (\%)** & **FPR (\%)** \\ \hline TNM0961 & 100 & 99.8962 & 99.9481 & 99.9011 & 0 \\ CQW0652 & 99.6558 & 99.4656 & 99.5606 & 99.1327 & 28.1250 \\ FSC0601 & 99.9911 & 99.9911 & 99.9911 & 99.9823 & 2.0833 \\ IJM0776 & 99.3363 & 99.4830 & 99.4096 & 98.8555 & 20.4545 \\ \hline \hline \end{tabular}
\end{table}
Table 7: Performance on four randomly selected users with the 80% training set.  
Figure 4: The performance changes of FAD and MG-UABD with increasing training set proportion.  
Figures 6 and 7 represent the distribution of the 70 anomalous users in one-dimensional and two-dimensional metric spaces, with each point representing an anomalous user. Figure 6 displays the distribution of all 70 anomalous users along the PRE (Precision), DTR (Detection Rate), F1, and FPR (False Positive Rate) axes under training set proportions of 20%, 40%, 60%, and 80%. As the proportion of training data increases, the points representing anomalous users on the PRE, DTR, and F1 axes gradually cluster towards the right (indicating improvement), while the points on the FPR axis move towards the left (indicating reduction). However, not all user points are shifted towards the center of the clusters, and some still form long tails.  
Figure 5: The anomaly detection performance of the model on randomly selected users varies with the proportion of the dataset.  
Figure 6: The one-dimensional spatial distribution of users in various indicators varies with the proportion of the dataset.  
Figure 7 visualizes the distribution of anomalous user points in a two-dimensional space with PRE (Precision) on the x-axis and DTR (Detection Rate) on the y-axis. With 20% of the training data, most anomalous users are scattered throughout the space. As the proportion of training data increases, the anomalous users gradually shift towards areas with higher PRE and DTR. Under the 20% training set setting, no anomalous user samples fall on the vertical axis where PRE equals 1, but under the 80% setting, several anomalous users do fall on the \"PRE = 1\" axis. This phenomenon indicates that increasing the training set improves the overall detection performance for anomalous users.