Method, apparatus, and computer-readable medium for detecting anomalous user behavior

An apparatus for efficient detection of anomalous user behavior on a computer network, the apparatus comprising:

• one or more processors;
• and
• one or more memories operatively coupled to at least one of the one or more processors and having instructions stored thereon that, when executed by at least one of the one or more processors, cause at least one of the one or more processors to:
• store user activity data corresponding to activity on the computer network that is collected over an observation interval, wherein the user activity data comprises a plurality of data objects corresponding to a plurality of users and wherein each data object in the plurality of data objects comprises a plurality of activity parameters;
• group the plurality of data objects into a plurality of clusters based at least in part on the plurality of activity parameters for each data object;
• calculate one or more outlier metrics corresponding to each cluster in the plurality of clusters, wherein each outlier metric in the one or more outlier metrics indicates measures a degree to which a corresponding cluster lies outside of is an outlier relative to other clusters in the plurality of clusters;
• calculate an irregularity score for each of one or more data objects in the plurality of data objects based at least in part on a size of a cluster which contains the data object and the one or more outlier metrics corresponding to the cluster which contains the data object;
• generate a plurality of object postures by encoding the irregularity score and the plurality of activity parameters for each data object in the plurality of data objects as an object posture, each object posture comprising a string data structure comprised of a plurality of sub strings, each sub string indicating a state of either the irregularity score or an activity parameter in the plurality of activity parameters for a corresponding data object over the observation interval;
• and
• identify anomalous activity of at least one user in the plurality of users based at least in part on a string metric measuring a distance between at least one object posture in the plurality of object postures and at least one previous object posture corresponding to a same user as the at least one object posture during a different observation interval prior to the observation interval.

At least one non-transitory computer-readable medium storing computer-readable instructions that, when executed by one or more computing devices, cause at least one of the one or more computing devices to:

• store user activity data corresponding to activity on the computer network that is collected over an observation interval, wherein the user activity data comprises a plurality of data objects corresponding to a plurality of users and wherein each data object in the plurality of data objects comprises a plurality of activity parameters;
• group the plurality of data objects into a plurality of clusters based at least in part on the plurality of activity parameters for each data object;
• calculate one or more outlier metrics corresponding to each cluster in the plurality of clusters, wherein each outlier metric in the one or more outlier metrics indicates measures a degree to which a corresponding cluster lies outside of is an outlier relative to other clusters in the plurality of clusters;
• calculate an irregularity score for each of one or more data objects in the plurality of data objects based at least in part on a size of a cluster which contains the data object and the one or more outlier metrics corresponding to the cluster which contains the data object;
• generate a plurality of object postures by encoding the irregularity score and the plurality of activity parameters for each data object in the plurality of data objects as an object posture, each object posture comprising a string data structure comprised of a plurality of sub strings, each sub string indicating a state of either the irregularity score or an activity parameter in the plurality of activity parameters for a corresponding data object over the observation interval;
• and
• identify anomalous activity of at least one user in the plurality of users based at least in part on a string metric measuring a distance between at least one object posture in the plurality of object postures and at least one previous object posture corresponding to a same user as the at least one object posture during a different observation interval prior to the observation interval.