Unsupervised Machine Learning Methods for Behaviour Analysis and Anomaly Detection in University Environment - Strnad, Pavel (2023)
The security of university information systems is currently mostly handled at the perimeter of the data network. It is not assumed that an attacker is able to penetrate the perimeter and cause damage inside the infrastructure. However, the continuous development in the cyber-attack field proves that it is necessary to prepare for situations when an attacker misuses the login credentials of one of the users and starts to cause damage to the information system undetected. Such incidents have also been observed in the past in the environment of the integrated information study system InSIS of the Prague University of Economics and Business. The detection of these incidents was mostly completely random or dependent on feedback from users who found something wrong with the system. In all the identified cases, the changes in the system were so significant that the attacker himself alerted to the ongoing cyber-attack by his actions. This demonstrates that information system administrators rely solely on the vigilance of their users to defend against these types of system intrusions. Therefor there is currently no automated form of defence against these attacks and no way of detecting these intrusions. It is only a question of how many user accounts can be abused without their owners’ knowledge even now. To address this problem, I founded the Hellhound AI project, where my colleagues and I are dedicated to detecting anomalous user behaviour in university information systems environments. This dissertation describes the part of the problem at hand that deals with cyber-attack detection using unsupervised machine learning algorithms, which is the primary focus of my work. This thesis was written in parallel with the dissertation being prepared by my colleague Ing. Lukáš Švarc, which focuses on solving the same problems using supervised machine learning algorithms for comparison.