Can user behavior be detected by machine learning?

I want to find a user who repeats certain actions.

here is example document ...
{"user_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:00.000"}
{"user_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:01.000"}
{"user_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:02.000"}
{"user_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:03.000"}
{"user_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:04.000"}
{"user_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:05.000"}

I want to know a user who repeats a and b actions for a short time.
Is it possible?
If possible, how do I set up?

The ML team recently introduced transforms which is very much geared towards behavioural analytics. It allows you to summarise behaviour of each entity using the aggregations framework and you can then run analysis on the "entity-centric" indices it creates.

I can see that outlier can be extracted by counting each number of 'action A' and 'action B' in transform.

like this...

But rather than the count of 'action A' and 'action B', I want to know how many times 'action A' and 'action B' occur in succession.
And when the number of consecutive occurrences is high, i want to detect this as an outlier.
For example, if a pattern is repeated in which a particular user attempts to connect to two specific ports continuously, we want to detect this as an outlier.

is it possible?

Sequences are harder to spot currently (it involves Painless scripting). Our recent acquisition of Endgame has provided technology to tackle this - the EQL language it provides is designed for these types of questions but we have work to do to incorporate into the core elasticsearch engine.

In the interim, you can write Painless scripts as parted of a ‘scripted’ aggregation using the transform api or write an old fashioned entity-centric update script.

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.