# Multi-Granularity User Anomalous Behavior Detection
## 5 Experiments
### Ablation Study
#### 5.4.1 Ablation of CAD and FAD  
This section of the experiment investigates the functions of the CAD and FAD modules. Figures 8 and 9 present the results of behavioral anomaly detection by each module under varying proportions of the training set. The CAD module screens all behavioral data for anomalies, while the FAD module further examines all actions associated with users flagged as anomalous by CAD. The MG-UABD represents the overall detection outcome, integrating the findings from both CAD and FAD. Given that the targets and volumes of data processed by CAD and FAD differ, the amounts of data they handle also vary with different training set configurations; specific details are provided in Table 8.  
Figure 7: The two-dimensional spatial distribution of users in various indicators varies with the proportion of the dataset. From Figure 8, it can be observed that under varying proportions of the training data, the Precision (PRE) of the CAD module is not high, yet the Detection Rate (DTR) is relatively high. This indicates that the CAD module misclassifies some anomalous behavior samples as normal, but correctly classifies most normal behavior samples. In other words, the CAD module performs well in detecting normal samples. Additionally, as illustrated in Figure 9, the False Positive Rate (FPR) of the CAD module is notably high, exceeding 95%, which is consistent with the high DTR. This signifies that a substantial number of anomalous behavior samples are incorrectly classified as normal, and thus, not detected by the CAD module. The FPR represents missed detections of anomalous behaviors. Although the CAD module has a high recall rate for normal samples when they constitute a significant portion of the dataset, it also tends to classify anomalous samples as normal, leading to a very high false alarm rate for anomalous samples, and consequently, lower detection accuracy. \begin{table}
\begin{tabular}{l r r r r} \hline \hline
**Module and Model** & **TP** & **TN** & **FP** & **FN** \\ \hline CAD & 20,962,409 & 161 & 7052 & 93 \\ \hline FAD (20\%) & 2,831,356 & 4500 & 1143 & 1298 \\ FAD (40\%) & 2,329,977 & 3823 & 620 & 862 \\ FAD (60\%) & 1,551,003 & 2634 & 302 & 504 \\ FAD (80\%) & 749,084 & 1385 & 141 & 221 \\ \hline MG-UABD (20\%) & 26,209,061 & 4675 & 1143 & 1298 \\ MG-UABD (40\%) & 19,656,907 & 3744 & 620 & 862 \\ MG-UABD (60\%) & 13,104,676 & 2607 & 302 & 504 \\ MG-UABD (80\%) & 6,552,369 & 1385 & 141 & 221 \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Confusion matrix indicators. Figure 8: The performance of the coarse and fined granularity modules and the overall model is affected by the proportion of the training set (PRE, DTR, F1, and ACC). The FAD module, although exhibiting a lower Detection Rate (DTR), shows an improvement in Precision (PRE) compared to the CAD module. This suggests that the FAD module performs better than the CAD module in detecting anomalous behavior samples, mitigating the misclassification of anomalous samples. Furthermore, the False Positive Rate (FPR) of the FAD module is reduced to below 20% compared to the CAD module, indicating a reduction in the misclassification of anomalous samples. The MG-UABD integrates the detection outcomes of both the CAD and FAD modules, combining the strength of the CAD module in detecting normal behavior samples with the strength of the FAD module in detecting anomalous behavior samples. This integration allows for the retention of effective detection of normal behavior samples, achieving a high DTR, while also improving the ability to accurately identify anomalous behavior samples, achieving a higher PRE. It is important to note that the CAD module detects all user behavior samples, which include a larger proportion of normal users and normal behavior samples. Consequently, it develops a stronger capability to detect normal samples. Since in this study \"positive\" refers to normal samples, the CAD module's Detection Rate (DTR) even surpasses that of the FAD module.