# Multi-Granularity User Anomalous Behavior Detection
## 7 Conclusions and Future Plans  
This article proposes a multi-granularity combined anomaly detection algorithm MG-UABD for internal threat detection. The model combines coarse-grained behavior detection with fine-grained user detection to improve the accuracy of detecting anomalous behaviors and users. The coarse-grained detection module detects all behavior data and identifies anomalous users through anomalous behavior. The fine-grained detection module constructs a separate detection model for each anomalous user and learns the specific behavior patterns of each user, and thus, improves the detection effect on the behavior of specific anomalous users. This study validated the effectiveness of the model through a large number of experiments, including comparing the accuracy of detecting anomalous behavior, conducting ablation experiments on various modules, and analyzing the correlation between anomalous users and anomalous behavior. The experimental results and analysis demonstrate that MG-UABD can effectively address challenges in detecting anomalous users and behaviors, and improve the accuracy and robustness of internal threat detection.  
The future plan of this work includes the following two aspects: firstly, quantitatively evaluating the degree of abnormality of anomalous users or behaviors, such as adding a quantitative abnormality evaluation mechanism in the coarse-grained detection module. By setting an abnormality threshold value, the number of anomalous users sent to the fine-grained detection module can be determined to save the hardware resource cost of model deployment. Secondly, exploring the addition of association rules in statistical methods for detection. For example, if a user copies certain files after sending and receiving emails containing specific types, there may be a necessary association within the behavior sequence. Adding these rules to the system will help increase the capability to detect potential insider threats.  
**Author Contributions:** Conceptualization, W.F.; methodology, Y.C. ([PERSON]); software, Y.C. ([PERSON]); validation, Y.W. and N.H.; formal analysis, Z.G.; investigation, Y.J.; resources, Y.C. ([PERSON]); data curation, Y.C. ([PERSON]); writing--original draft preparation, W.F.; writing--review and editing, Z.G.; visualization, W.F.; supervision, Y.J.; project administration, Z.G.; funding acquisition, Y.J., N.H. and Z.G. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This work was supported in part by the Major Key Project of Pengcheng Laboratory (Grant No. PCL2024A05), the Shenzhen Science and Technology Program (No. KJZD20231023094701003), the opening project of science and technology on communication networks laboratory (No. FFX24641X007), and the National Natural Science Foundation of China (Grant No. 62372137).  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** The original data presented in the study are openly available in CERT of CMU at [[https://kilttub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247](https://kilttub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247)]([https://kilttub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247](https://kilttub.cmu.edu/articles/dataset/Insider_Threat_Test_Dataset/12841247)) (accessed on 6 November 2024).  
**Conflicts of Interest:** The authors declare no conflicts of interest. The funders had no role in the design of the study; in the collection, analyses, or interpretation of data; in the writing of the manuscript; or in the decision to publish the results.