# Multi-Granularity User Anomalous Behavior Detection
## 4 Methodology
### Coarse-Grained Anomaly Detection (CAD)  
The purpose of the coarse-grained anomaly detection (CAD) module is to determine the presence of anomalous behavior based on the all behavior data of all users. This module trains and tests user behavior data at a weekly time granularity. Firstly, it calculates the number of weeks in which all user behavior starts and ends in the dataset, and determines the time range for inputting user behavior data into the model. This step needs to ensure that the range of weeks for the selected behavior data are earlier than the weeks of the earliest user who ended all behaviors, so as to ensure that no user in this stage of detection can be detected, because the behaviors end earlier and do not exist in the test set. At the same time, behavior data are selected from the first few weeks to form a training set of user historical data to train the model. Then, the training set data are processed by combining oversampling and undersampling, and the processed data are used as the training set and input into the random forest model for training. Finally, the remaining data are input in a weekly order as the test set to simulate detecting user behavior at a later time. When a behavior anomaly of a user is detected in a certain week, the fine-grained model is used to analyze and detect the anomalous behavior of this user in that week.  
Coarse-grained anomaly detection takes the behavior data of all users in the first several weeks as input for the random forest model. We have tried various machine learning classification algorithms, and the random forest model has the best performance for anomaly detection. All user behavior data were divided into a training set \(\mathcal{D}\) and a testing set \(\mathcal{T}\) at weekly granularity as inputs to the random forest. A random forest is composed of multiple decision trees, each of which performs binary judgment on the current behavior and outputs the judgment result. The decision tree integrates the outputs of all decision trees as the final result of the current behavior judgment. If anomalous behavior is detected, the user corresponding to that behavior is input into the fine-grained anomaly detection module. The algorithm for the coarse-grained anomaly detectionmodule based on random forest is shown in Algorithm 1, where algorithm input is a training set of the behavior data of all users.  
```
1:procedureRandom Forest(\(\mathcal{D}\), \(T\), \(m_{try}\)) \(\triangleright\)\(\mathcal{D}\): Training set of the user behavior data, \(T\): the number of tree, \(m_{try}\): Maximum number of features
2:\(\mathcal{F}\leftarrow\emptyset\)\(\triangleright\) Initialize forest as empty
3:for\(t=1,\ldots,T\)do
4:\(\mathcal{D}_{t}\leftarrow\) Extract bootstrap sample from \(\mathcal{D}\)
5:\(T_{t}\leftarrow\) Building a decision tree(\(\mathcal{D}_{t}\), \(m_{try}\))
6:\(\mathcal{F}\leftarrow\mathcal{F}\cup\{T_{t}\}\)\(\triangleright\) Add trees to the forest
7:endfor
8:return forest \(\mathcal{F}\)
9:endprocedurePredict(\(\mathcal{F}\), test sample of user behavior data \(x\))
10: Initialize counter \(C\leftarrow\emptyset\)
11:for each tree \(T_{t}\) in \(\mathcal{F}\)do
13:\(c_{t}\gets T_{t}.predict(x)\)\(\triangleright\) Making Predictions for \(x\)
14: Update Counter \(C[c_{t}]+=1\)
15:endfor
16: Return the most frequently occurring category (normal or anomalous) in \(C\) as the prediction result
17:endprocedure
```  
**Algorithm 1** Training and prediction of MG-UABD based on Random Forest.  
The coarse-grained anomaly detection module takes the behavior data of all users within a limited time range as input to a random forest, and outputs the binary classification judgment results for user behavior. Based on the judgment of normal and anomalous behavior data, it identifies the user who initiated anomalous behavior, i.e., the anomalous user, and inputs it into the subsequent fine-grained user behavior anomaly detection analysis.