## 3 Model Structure
### Attribute Analysis and Standardization  
In the calculation of campus network flow [26], there is no distinction between international flow and domestic flow, so the international upstream flow and domestic upstream flow can be combined into upstream flow \"Flow_up\", and the international downstream flow and domestic downstream flow can be combined into the downstream flow \"Flow_down\". The upstream flow generally includes the flow consumed by users sending data requests to the server through the computer and the flow consumed by uploading data. Generally, the consumption of users is less, and individual users uploading data to cloud tools such as the network disk may generate a large amount of upstream flow. Downstream flow generally refers to the flow consumed by data transmission from the network end to the user, including downloading data, watching videos, and data transmission from the network server or other computers to the user's computer. In addition, the particularity of authentication gateway data in a campus network is that the upstream flow is not included in the usage flow, so the user flow is mainly composed of all the downstream flow, that is, Flow = Flow_down_I + Flow_down_N, which can be regarded as a key feature of non-directional online behavior. Considering the validity of user attributes, we filtered all the collected records according to the following rules. Rule 1: the user's login time is more than 10 min, i.e., Length_time > 10;  
Rule 2: the user's usage flow is greater than 10 MB each time, i.e., Flow > 10. In order to integrate data with different attributes, the first step is to nondimensionalize [27], which is to transform the original data with a measurement into data without a unit. The nondimensional data processing solves the comparability between the network \begin{table}
\begin{tabular}{c c} \hline \hline
**Attribute Name** & **Description** \\ \hline User ID & The user’s account number is unique for each campus network user. \\ Login\_time & The time each user logs in to the campus network. \\ Logout\_time & The time when the user logs off from the campus network. \\ Length\_time & The duration of each login to the campus network, in minutes. \\ Flow & The network flow is used for each login, in MB. \\ Flow\_up\_I & The international uplink flow is used for each login, in MB. \\ Flow\_down\_I & The international downlink flow is used for each login, in MB. \\ Flow\_up\_N & The domestic uplink flow is used for each login, in MB. \\ Flow\_down\_N & The domestic downlink traffic is used for each login, in MB. \\ IP & Internet Protocol Address. \\ MAC & Media Access Control Address. \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Several important attributes and explanations of non-directional online behavior. behavior data of different attributes of campus network users, which makes the fusion analysis of different attributes possible. For example, in the original data, the feature scales and units such as Length_time and Flow were not consistent, so the original data needed to be centralized and standardized so that different features had the same scale. The data with the mean value of 0 and a standard deviation of 1 are calculated by the Formula (1). \[x^{\prime}=\frac{x-\mu}{\sigma} \tag{1}\]  
where, \(x\) is the attribute value of different dimensions of each record, i.e., sample point; \(\mu\) is the mean value; \(\sigma\) is the standard deviation. In many users, there were some similar groups, which were clustered. There were also some abnormal users outside of the groups, which were treated as extreme values. However, taking into account the possible surge in online time or the use of traffic was precisely the main factor affecting academic performance. Therefore, the maximum value was retained. In the clustering results, these users were also analyzed as a group in order to find their abnormal behavior patterns and compare them with other user groups. The minimum value of 0 was filtered through the above rules.