# Multi-Granularity User Anomalous Behavior Detection
## 4 Methodology
### Data Fusion and Preprocessing
#### 4.2.2 Feature Construction  
The five types of user behavior data are different and require the design and construction of different features. Feature construction can be divided into two types. (1) Constructing features separately based on behavior information, i.e., different featuresconstructed according to different behaviors. For behaviors involving email sending, the feature is constructed according to information such as the number of recipients, email length, and whether it is an external email. (2) Constructing features combining user identity information and behavior information, such as extracting work time hazard rating features based on whether the occurrence time of user behavior is within normal working hours. We combine the features constructed in these two ways to obtain the complete behavior features. The features of each type of behavior are shown in Table 3.  
\"Id\", \"User\", and \"Date\" are the common features of all kinds of behavior data. \"Id\" denotes the unique identification code of the action record. \"User\" denotes the subject who make this action. \"Date\" denotes the time of the action record. For behavior data of type \"Logon/Logoff\", the unique feature is the activity description: \"Logon\" or \"Logoff\". For behavior data of type \"File\", the unique features include the \"Filename\" and \"Content\" of the file. For behavior data of type \"HTTP\", the unique features include \"PC\", the \"URL\" accessed by user, and the \"Content\" of the webpage. For behavior data of type \"Email\", unique features include the sender \"From\", the recipients \"To\", \"Cc\", and \"Bcc\". If the email contains attachments, the unique features includes the \"Size\", \"Attachment\", and \"Content\" of the attachment. For behavior data of type \"Device\", unique features is the activity description: \"connect\" or \"disconnect\".  
After completing feature construction, it is necessary to perform numerical mapping on the features, represented by text. After converting feature values into numerical values, the original user identity information and user behavior data are transformed into a form that can be learned by the model for training.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Activities** & **Action** & **Description** \\ \hline Logon/Logoff & Logon & User logged on a computer \\ activity & Logoff & User logged off from a computer \\ \hline \multirow{4}{*}{File activity} & Copy.exe file & User copied an exe file to a removable media device \\  & Copy.doc file & User copied an doc file to a removable media device \\  & Copy.pdf file & User copied an pdf file to a removable media device \\  & Copy.txt file & User copied an txt file to a removable media device \\  & Copy.jpg file & User copied an jpg file to a removable media device \\  & Copy.zip file & User copied an zip file to a removable media device \\ \hline \multirow{4}{*}{HTTP activity} & Neutral website & User visited a neutral website \\  & Hacktivist website & User visited a hacktivist website \\  & Cloudstorage website & User visited a cloudstorage website \\  & JobHunting website & User visited a jobhunting website \\ \hline \multirow{2}{*}{Email activity} & Internal email & All recipients are company email address \\  & External email & There is an external address \\ \hline \multirow{2}{*}{Device activity} & Connect & User inserted a removable media device \\  & Disconnect & User removed a removable media device \\ \hline \hline \end{tabular}
\end{table}
Table 2: User behavior types, actions, and descriptions.  
\begin{table}
\begin{tabular}{l l l} \hline \hline
**Behavior Type** & **Features** & **Common Features** \\ \hline Logon/Logoff & Id, User, Date, Activity (logon or logoff) \\ File & Id, User, Date, Filename, Content \\ HTTP & Id, User, Date, PC, URL, Content & Id, User, Date, \\  & Id, User, Date, From, To, Cc, Bcc, Size, Attachment, \\  & Content \\ Device & Id, User, Date, Activity (connect or disconnect) \\ \hline \hline \end{tabular}
\end{table}
Table 3: User behavior features.