Vol.44, No.2, 2023, pp.1679-1689, doi:10.32604/csse.2023.026526
Cyberattack Detection Framework Using Machine Learning and User Behavior Analytics
  • Abdullah Alshehri1,*, Nayeem Khan1, Ali Alowayr1, Mohammed Yahya Alghamdi2
1 Information Technology Department, Faculty of Computer Science and Information Technology, Al Baha University, Al Baha, 65799, Saudi Arabia
2 Computer Science Department, Faculty of Science and Arts at Buljurashi, Al Baha University, Al Baha, 65799, Saudi Arabia
* Corresponding Author: Abdullah Alshehri. Email:
Received 29 December 2021; Accepted 27 February 2022; Issue published 15 June 2022
This paper proposes a novel framework to detect cyber-attacks using Machine Learning coupled with User Behavior Analytics. The framework models the user behavior as sequences of events representing the user activities at such a network. The represented sequences are then fitted into a recurrent neural network model to extract features that draw distinctive behavior for individual users. Thus, the model can recognize frequencies of regular behavior to profile the user manner in the network. The subsequent procedure is that the recurrent neural network would detect abnormal behavior by classifying unknown behavior to either regular or irregular behavior. The importance of the proposed framework is due to the increase of cyber-attacks especially when the attack is triggered from such sources inside the network. Typically detecting inside attacks are much more challenging in that the security protocols can barely recognize attacks from trustful resources at the network, including users. Therefore, the user behavior can be extracted and ultimately learned to recognize insightful patterns in which the regular patterns reflect a normal network workflow. In contrast, the irregular patterns can trigger an alert for a potential cyber-attack. The framework has been fully described where the evaluation metrics have also been introduced. The experimental results show that the approach performed better compared to other approaches and AUC 0.97 was achieved using RNN-LSTM 1. The paper has been concluded with providing the potential directions for future improvements.
Cybersecurity; deep learning; machine learning; user behavior analytics
Cite This Article
A. Alshehri, N. Khan, A. Alowayr and M. Yahya Alghamdi, "Cyberattack detection framework using machine learning and user behavior analytics," Computer Systems Science and Engineering, vol. 44, no.2, pp. 1679–1689, 2023.
This work is licensed under a Creative Commons Attribution 4.0 International License , which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.