# Multi-Granularity User Anomalous Behavior Detection
## 5 Experiments
### Correlational Analysis of Users and Behaviors  
Users' anomalous behaviors encompass various types, and this part of the experiment investigates the distribution of anomalous user behaviors across these types during the fine-grained anomaly detection phase, aiming to understand the patterns among different types of behaviors. For this part, the coarse-grained anomaly detection module is trained separately with seven different data types as input, and users identified through the analysis of different behavioral data are sent to the corresponding fine-grained anomaly detection module for that behavior type. Figure 11 illustrates the correspondence between normal and anomalous users across seven behavior types. For visualization purposes, we have selected only a portion of the normal users from the entire dataset, focusing our analysis on the distribution of behavior types for anomalous users. As shown in the figure, the behavior composition of normal users primarily consists of \"logon\", \"logoff\", and \"http\", whereas the behavior composition of anomalous users is mostly concentrated in \"connect\", \"disconnect\", and \"email\". The \"http\" type has the largest volume of data, with both normal and anomalous users engaging in this type of behavior. Figure 10: The impact of oversampling on model performance. We investigated the detection of anomalous users using different types of anomaly detection data. Figure 12 shows the number of anomalous users detected by the fine-grained anomaly detection module based on various behavior types. From the figure, it can be seen that the behavior types that detect the highest number of anomalous users are: \"http\", \"connect\", and \"disconnect\". Among these, \"normal user\" refers to the correction of anomalous users identified by the coarse-grained detection module; these users were initially flagged as anomalous by CAD but were subsequently determined to be normal after being processed by FAD. \"Logon\" and \"logoff\" have the highest number of misclassified anomalous users that were corrected, with relatively fewer anomalous users detected. Regardless of whether users are normal or anomalous, the \"file\" type of behavior has the least amount of data, and correspondingly, the number of anomalous users detected based on this type is also the lowest. Figure 11: The correspondence between user types and behavior types. Figure 12: Detection correction of CAD by FAD. Figure 13 displays the effectiveness of the MG-UABD fine-grained anomaly detection module in detecting anomalous behaviors across different behavior types. From the figure, it can be observed that the best-performing behavior types for anomalous behavior detection are \"http\" and \"file\", followed by \"logon\" and \"logoff\". The poorest performance is seen in \"connect\", \"disconnect\", and \"email\". Combining the results from Figure 12, we can infer that the behavioral characteristics of anomalous users are concentrated in \"connect\" and \"disconnect\", but once individual anomalous users are subjected to anomalous behavior detection, the distinction between normal and anomalous features for these types is not clear, leading to a higher rate of missed detections. The \"http\" type has the largest volume of data, and the precision, detection rate, and low false-negative rate for behavior detection based on this type are all high. While the \"file\" type of behavior data are less prevalent, the detection results are also favorable. In summary, the quantity and characteristics of anomalous users' behaviors are more concentrated on device operations (\"connect\" and \"disconnect\") and internet usage (\"http\"). However, the effectiveness of detecting anomalous behaviors based on device operation behaviors is not as good as that based on internet usage and file behaviors. The detection performance based on a single type of behavior is inferior to that achieved by integrating multiple types of behaviors for comprehensive detection.