Workshop on Statistical and Machine
Learning Techniques in Computer
Intrusion Detection
Graph Theoretic Methods for Profiling Users by Their
Network Activity
David Marchette
Abstract:
In profiling user activity, whether for fraud or masquerader detection
or for marketing or to improve services, two fundamental questions need
to be answered: are users similar to themselves, and are they different
from each other. The ways in which they differ, provided that these are
sufficiently consistent internally, will be key features to use in identifying
the user. We will look at some statistics computed on random intersection
graphs, to assess the significance of the clustering that is observed
in user behavior.