Abstract

The paper describes the proposed approach for classification in an unbalanced class environment and demonstrates it in the context of an anomaly detection system in user behaviour. The proposed approach is aimed on lessening the number of false-negative cases – cases, when an anomaly was recognized as normal event. The proposed approach is based on implementing LSTM neural network; it includes pre-processing flow data and splitting it into subsets by the user groups and training individual LSTM network for each group. The proposed approach was tested by experimenting with different neural network types and structures, as also testing in balanced and unbalanced class environments, including testing with and without LSTM network.

中文翻译：

---

在不平衡环境下的用户行为分析中使用LSTM网络进行分类

摘要

本文介绍了在不平衡类环境中分类的建议方法，并在用户行为异常检测系统的上下文中进行了演示。提议的方法旨在减少假阴性病例的数量，即那些异常被确认为正常事件的病例。所提出的方法基于实现LSTM神经网络。它包括预处理流数据，并由用户组将其划分为子集，并为每个组训练单独的LSTM网络。通过在不同的神经网络类型和结构上进行实验来测试提出的方法，并在平衡和不平衡的类环境中进行测试，包括使用和不使用LSTM网络的测试。