Algorithm for detecting anomalous behavior of users of automated systems based on machine learning methods

Currently, a relevant area of research is the development of modern systems for analyzing user behavior and entities, which are professionally known as user behavior and entity behavior analytics systems. It is proposed to consider the possibility of building such systems using machine learning methods. This is due to an increase in the sources and volume of user data, as a result of which manual analysis is labor-intensive, and classical methods based on statistics or rules do not always provide the required quality. The aim of the work is to build an effective machine learning algorithm for the task of detecting anomalies in data. An algorithm for detecting abnormal behavior of users of automated systems is proposed, as well as an optimization algorithm based on the artificial immune system for selecting the best hyperparameters of the algorithm. The anomaly detection algorithm is based on the classification of user behavior in the system based on their actions using the generative-adversarial network model. The proposed algorithm makes it possible to generate additional samples with a general probability distribution in order to reduce the implementation time and classify users based on the formed patterns of normal behavior. A distinctive feature of the algorithm is its ability to adapt to a real system, learning from user data while maintaining a given classification accuracy due to the automatic selection of optimal hyperparameters. The scientific novelty of the proposed algorithm consists in adding a clustering procedure to the process of data annotation before training a machine learning model, as well as adapting a generative-adversarial network for the task of detecting anomalies in data by changing the learning algorithm. The proposed approach will make it possible to detect deviations from normal user behavior with high accuracy in automated mode and close to real time, which will reduce the processing time for information security events.