User Profiling in Anomaly Detection of Authorization Logs

In digital age, the valuable asset of every company is their data. They contain personal information, companies and industries data, sensitive government communications and a lot of more. With the rapid development in IT technology, accessing the network become cheaper and easier. As a result, organizations are more vulnerable to both insiders and outsider threat. This work proposes user profiling in anomaly detection and analysis of log authorization. This method enables companies to assess each user's activities and detect slight deviation from their usual pattern. To evaluate this method, we obtained a private dataset from NextLabs Company, and the CERT dataset that is a public dataset. We used random forest for this system and presented the results. The result shows that the algorithm achieved 97.81% of accuracy.