# Unexpected-Behavior Detection Using TopK Rankings for Cybersecurity
## 3 Network User Profiles for Anomaly-Based Intrusion Detection Systems  
The construction of profiles based on network traffic for representing the normal behavior in anomaly-based detection IDSs has been part of the research on computer network security.  
Many research works on anomaly-based detection systems validate their proposals using common datasets like KDD-CUP99 [11] and NLS-KDD [12]. The former is an artificial dataset for testing intrusion detection systems, and the latter is a more realistic dataset where traffic data was generated from real profiles. The main problem with these datasets is that they contain many application-specific fields (e.g., \"number of failed logins\"), such that they are not available on raw real network traffic.  
[PERSON] [13] proposes an approach for profiling traffic behavior: he identifies and analyzes clusters of hosts or applications that exhibit similar communication patterns. In this approach, he uses bipartite graphs to model network traffic at the internet-facing links of the border router; then, he constructs one-mode projections of bipartite graphs to connect source hosts that communicate with the same destination host(s) and to connect destination hosts that communicate with the same source host(s). These projections enable similarity matrices of internet end-hosts to be built, where similarity is characterized by the number of common destinations or sources between two hosts. Based on these end-hosts matrices, at the same network prefixes, a simple spectral clustering algorithm is applied to discover the inherent end-host behavior cluster.  
[PERSON] [13] carried out an analysis over a 200-GB dataset collected from an internet backbone of 8.6 GB/s bandwidth. The data was reduced by adding packet traces into 5-tuple network flows. The dataset was built using 24-bit network prefixes with timescales of 10 s, 30 s, and 1 min; these timescales were chosen because they produced the highest percentages of hosts in the top cluster. [PERSON] concluded the following: (1) there was no correlation between the number of observed hosts and the number of behavior clusters, (2) the majority of end-hosts remained in the same behavior cluster over time, and (3) the profiling of network traffic in network prefixes detected anomalous traffic behaviors.  
A similar approach was employed by [PERSON] [14] using traffic at port 80 (HTTP protocol), and integrating the destination URL instead of the IP address. One of the conclusions was that 93% of the hosts remained in the same behavior cluster.  
[PERSON] et al. [15] present an intrusion detection technique using network-traffic profiling and an online sequential extreme machine-learning algorithm. The proposed methodology runs two profiling procedures: alpha and beta profiling. The former creates profiles on the basis of protocol and service features, and the latter groups the alpha profiles in order to reduce the number of profiles. The authors conducted three different experiments: (1) using all features and alpha profiling; (2) using only some features and alpha profiling; and (3) using only some features, alpha profiling, and beta profiling. The best results were obtained from the last experiment using both profiling methods. The dataset used in this work was NLS-KDD.  
[PERSON] [16] presents an anomaly-based IDS that builds the profile using three different data mining algorithms that identified the frequent patterns. The author evaluated the profile against real-time traffic, obtaining high detection rates and low false alarm rates.  
As we can see, all these works used the traffic captured at a far point from the end-user host, even outside the local network of the user, leaving the internal network security unattended. On the other hand, the use of profiles has proved to be feasible to either identify or specify network behaviors.