Modelling evolving user behaviours

Knowledge about computer users is very beneficial for assisting them, predicting their future actions or detecting masqueraders. In this paper, a new approach for creating and recognizing automatically the behaviour profile of a computer user is presented. In this case, a computer user behaviour is represented as the sequence of the commands (s)he types during her/his work. This sequence is transformed into a distribution of relevant subsequences of commands in order to find out a profile that defines its behaviour. Also, because of a user profile is not necessarily fixed but rather it evolves/changes, we propose an evolving method to keep up to date the created profiles using an evolving systems approach. In this paper we combine the evolving classifier with a trie-based user profiling to obtain a powerful self-learning on-line scheme. We also develop further the recursive formula of the potential of a data point to become a cluster centre using cosine distance which is provided in the Appendix. The novel approach proposed in this paper can be applicable to any problem of dynamic/evolving user behaviour modelling where it can be represented as a sequence of actions and events. It has been evaluated on several real data streams.