# Can user behavior be detected by machine learning?

**URL:** <https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253>\
**Category:** Elasticsearch\
**Created:** [November 25, 2019, 9:10am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253 "2019-11-25T09:10:40Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [November 25, 2019, 9:10am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253/1 "2019-11-25T09:10:40Z")

</div>

I want to find a user who repeats certain actions.

here is example document ...  
{"user\_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:00.000"}  
{"user\_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:01.000"}  
{"user\_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:02.000"}  
{"user\_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:03.000"}  
{"user\_id":"user01", "action":"A", "@timestamp":"2019-11-25 06:00:04.000"}  
{"user\_id":"user01", "action":"B", "@timestamp":"2019-11-25 06:00:05.000"}

I want to know a user who repeats a and b actions for a short time.  
Is it possible?  
If possible, how do I set up?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [November 25, 2019, 9:39am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253/2 "2019-11-25T09:39:12Z")

</div>

The ML team recently introduced [transforms](https://www.elastic.co/guide/en/elasticsearch/reference/current/transforms.html) which is very much geared towards behavioural analytics. It allows you to summarise behaviour of each entity using the aggregations framework and you can then run analysis on the "entity-centric" indices it creates.

---

<div class="post-metadata">

**Author:** ![Yungyoung\_Ok](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yungyoung_ok/32/43465_2.png) [@Yungyoung\_Ok](https://discuss.elastic.co/u/Yungyoung_Ok)\
**Post date:** [November 26, 2019, 12:56am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253/3 "2019-11-26T00:56:42Z")

</div>

thanks.  
I can see that outlier can be extracted by counting each number of 'action A' and 'action B' in transform.

like this...

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/2/5/25e4e0ed786b1d6ce47dd739fe00952c37af185f.png)

But rather than the count of 'action A' and 'action B', I want to know how many times 'action A' and 'action B' occur in succession.  
And when the number of consecutive occurrences is high, i want to detect this as an outlier.  
For example, if a pattern is repeated in which a particular user attempts to connect to two specific ports continuously, we want to detect this as an outlier.

is it possible?

---

<div class="post-metadata">

**Author:** ![Mark\_Harwood](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/mark_harwood/32/10538_2.png) [@Mark\_Harwood](https://discuss.elastic.co/u/Mark_Harwood)\
**Post date:** [November 26, 2019, 8:49am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253/4 "2019-11-26T08:49:41Z")

</div>

> [@Yungyoung\_Ok](#):
>
> if a pattern is repeated in which a particular user attempts to connect to two specific ports continuously,

Sequences are harder to spot currently (it involves Painless scripting). Our recent acquisition of Endgame has provided technology to tackle this - the EQL language it provides is designed for these types of questions but we have work to do to incorporate into the core elasticsearch engine.

In the interim, you can write Painless scripts as parted of a ‘scripted’ aggregation using the transform api or write an old fashioned [entity-centric update script.](https://twitter.com/elasticmark/status/1009380268409610240?s=21)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 24, 2019, 8:49am UTC](https://discuss.elastic.co/t/can-user-behavior-be-detected-by-machine-learning/209253/5 "2019-12-24T08:49:42Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.