User Login Behavior Analysis and Anomaly Detection using Machine Learning

Part 2

In Part 1 of this article https://medium.com/@khurram.khan_91792/user-login-behavior-analysis-and-anomaly-detection-using-machine-learning-7e6f0f7e50ae I have explained the approach in detail for implementing a solution that can gather user login data and store them in a dataset for further analysis. In this article I will explain how I have used this data to apply different machine learning algorithms to detect anomalous user sessions.

Stage 3. Anomaly detection:

Exploratory data analysis (EDA):

I have created different datasets for total login counts from the event logs dataset and created some charts to see data distribution. Following line chart is showing user id on x axis and user aggregate login count per day on y axis. The chart is showing average 11 login counts for users per day with some peaks with maximum value of 36 login counts. I will be assuming that this as a normal trend without anomalies

Following line chart is showing login counts for all users for each hour with hours on x and total login count on y axis. As the users are operating from different time zones, we can see the peak on different time slots