# Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity
## 5 Unexpected Behavior Identification  
This work proposes a methodology capable of detecting an unexpected network behavior--which might be an intrusion--based on computing the user's predominant behavior. This methodology is depicted in Figure 6 and consists of the following phases:  
1. Continuously capture real-time network traffic at the host;
2. Build a TopK ranking every \(\Delta t\) seconds from the most recently captured traffic;
3. Calculate the similarity \(S\) of each TopK to the user profile;
4. Identify the predominant behavior \(PB\) every \(\Delta w\) seconds;
5. Evaluate the current predominant behavior;
6. Determine whether or not to trigger an alarm.  
The first two phases employ the same algorithms and parameters as those used to build the user profile. The similarity is calculated using the mechanism offered by the profiling system [17], which is based on the average overlap measure [18].  
Figure 7 depicts a sequence of \(S\) calculated during six hours of capturing real-time traffic of a single user. We can observe that the points are too disperse to conclude that there is an unexpected  
Figure 5: Depicting timeframe overlapping in the profile building process.  
behavior by evaluating a single similarity value \(S\). Therefore, a method that analyzes many successive points will be useful to conclude whether the predominant behavior is actually unexpected or not.  
In order to identify the predominant behavior within a sequence of \(S\), we use a signal-processing technique called moving-average filter, formally defined as:  
\[y[n]=\frac{1}{M}\sum_{l=w_{1}}^{w_{2}}x[l], \tag{1}\]  
where \(M\) is the number of points at the time-frame \([w_{1}\ldots w_{2}]\), and \(x[l]\) is the value of the point at time-frame \(l\). The filter reduces these points into a single point \(y[n]\) by calculating the mean value [19]. This value corresponds to the predominant behavior \(PB\) during time-frame \([w_{1}\ldots w_{2}]\).  
The next time-frame starts at \(w_{1}+\Delta w\). In this implementation, \(\Delta w\) is smaller than \(w_{2}-w_{1}\) to guarantee that time-frames overlap. Figure 8 depicts the operation of the moving-average filter and how time frames overlap.  
Figure 9 shows an example of applying the moving-average filter over an \(S\) succession. Blue circles denote \(S\) values and orange diamonds represent the \(PB\) values. We can observe that the orange diamonds follow the predominant behavior of blue circles.  
Figure 6: Block diagram of the proposed methodology for detecting an unexpected behavior.  
Figure 7: Plot of all calculated average overlaps of real-time against the profile during 6 h.  
The evaluation of the current \(PB\) is based on comparing it continuously with a threshold value \(T\), where \(T\) denotes the minimum value for a predominant behavior to be tagged as expected. Therefore, if \(PB\) is below \(T\) during \(N\) time-frames, we can conclude that the user is having an unexpected behavior and, therefore, a possible attack. In such a case, an alarm should be triggered.  
Figure 9 also includes a horizontal line at \(PB=0.40\) to represent a valid threshold value \(T\) for the user being analyzed. Thus, we can appreciate an unexpected behavior starting at 11:00 h.