{'fraction_non_alphanumeric': 0.013186813186813187, 'fraction_numerical': 0.0, 'mean_word_length': 5.26605504587156, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A Deterministic Profiling Approach to support Behaviour Anomaly Detection

Tracking Behavior Anomalies for identifying user impersonations is a field of active research. While various approaches have been used, it remains true that this process is still not deterministic or controllable enough for practical use. We present a new approach that aims to make the process of profiling behavior patterns of users deterministic by using a Rule-base to assign scores to various events. This also makes such a system highly controllable by permitting real-time modifications to the rule base. By combining asymmetric encryption with an XML based representation of behavior information, we have also made the profiling process a one-way task, where a compromised profile does not reveal sensitive information about the profiled user. We developed and tested a software system to evaluate the concept, and through this we have demonstrated how it is possible to ensure that reporting and monitoring components distributed over a network are not compromised, and our entire system functions on an XML based open, secure protocol. We also discuss the applicability of network packet capture as a source of behavior information. Our results indicate that we have been able to develop a deterministic, secure and extensible framework for distributed behavior anomaly detection.