← VCE Data Analytics U4O2

User behaviour analytics: building a baseline

Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 134

Understanding User behaviour analytics: building a baseline in VCE Data Analytics U4O2

What it does: These recorded login times from past days are used to build the normal login pattern part of the baseline. Storing the baseline under one user's name shows it is a per-user baseline, not one shared rule for everyone. A baseline is per-user. A payroll officer and a software developer have different normal behaviour, so each needs their own baseline. Without a baseline, the system has no idea what counts as unusual. Activity that departs from the baseline can then be flagged.

Common mistakes: A baseline is built per user. It should average Ava's own login hours (hours), not the hours of all users, otherwise it no longer shows what is normal for Ava. Each pass overwrites one single baseline, so only the last user's pattern is kept. It should store a separate baseline for each user, as in baselines[user] ← build(user).

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add User behaviour analytics: building a baseline to a class →

This module's key terms are also in a printable crossword (Modules 115–134) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
What does a user behaviour analytics (UBA) system first build for each user?
A baseline of how that user normally behavesA list of every password the user has ever used
Matches
baseline = average_of_all_staff use baseline for every user
↓
Using one baseline for all users ignores that each person behaves differently. The baseline must be built per user.
Applying
Meanings
Term
User behaviour analytics
Meaning
Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.
Practice
FOR each user IN users
Testing
Gaps
baseline ← (logins)
Check Answer
Spots
2hours ← login_hours(user, 30)
3baseline ← average(all_users)

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Nebula Cat' badge — Orbit Debugger, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does a user behaviour analytics (UBA) system first build for each user?
A. A baseline of how that user normally behaves ✓
B. A list of every password the user has ever used
UBA records normal activity such as login times, locations and files accessed. This creates a per-user baseline that later activity is compared against.
2. Which is an example of a normal login pattern that could form part of a baseline?
A. Logging in from an unknown country at 3am
B. Logging in from Melbourne between 8am and 5pm on weekdays ✓
A normal login pattern is what the user usually does, such as regular times and locations. The 3am login from an unknown country would depart from the baseline and be flagged.
3. A baseline in user behaviour analytics is the same for every user in the organisation.
A. True: one baseline covers all users
B. False: each user has their own baseline ✓
A baseline is per-user. A payroll officer and a software developer have different normal behaviour, so each needs their own baseline.
4. Which is typical data access that a baseline might record?
A. A payroll officer opens the payroll files each fortnight ✓
B. A payroll officer downloads the entire customer database at midnight
Typical data access is the files and systems a user regularly uses for their job. Bulk downloads of unrelated data would be outside the baseline.
5. Why does UBA need to record normal behaviour over time before it can flag anything?
A. It needs a baseline to compare new activity against ✓
B. It needs to wait until a breach has already happened
Without a baseline, the system has no idea what counts as unusual. Activity that departs from the baseline can then be flagged.

Match the Pairs

baseline = {"login_hours": "8am-5pm", "city": "Melbourne"} → A per-user baseline that stores a user's normal login times and location
files_per_day = [12, 10, 15, 11] → Typical data access recorded over several days to show how many files a user normally opens
A normal login pattern is learned from a user's past logins, such as the usual hours they sign in → usual_hours = ["08:15", "08:30", "08:45"]
Each user gets their own baseline, so one user's normal is stored separately from another's → baselines["ava"] = {"files": 12}
baseline = average_of_all_staff use baseline for every user → Using one baseline for all users ignores that each person behaves differently. The baseline must be built per user.
if login_hour != 3: build_baseline(user) → A baseline is built from many normal past logins, not from a single unusual event or a fixed rule.

Key Term

User behaviour analytics
Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.

Fill in the Blanks

1. logins ← getLogins(user, 30) baseline ← AVERAGE(logins)
Hint: Type the function that works out a user's typical value from their past logins.
2. IF loginCountry ≠ baselineCountry THEN flag("unusual location") END IF
Hint: Type the comparison operator that tests whether the login country is not the same as the user's usual country.
3. IF filesToday > baselineFiles * 10 THEN flag(user) END IF
Hint: Type the function name that marks activity far outside the user's usual data access for review.
4. FOR EACH user IN staff baseline[user] ← AVERAGE(logins[user]) END FOR
Hint: Type the loop variable that makes each baseline belong to one individual person.
5. IF loginHour > baselineEnd THEN flag("late login") END IF
Hint: Type the comparison operator that tests whether the login happened later than the normal window.

Spot the Error

Question 1
A user ← 'Ava'
B hours ← login_hours(user, 30)
C baseline ← average(all_users)
D print(baseline)
Line C — A baseline is built per user. It should average Ava's own login hours (hours), not the hours of all users, otherwise it no longer shows what is normal for Ava.
Question 2
A FOR EACH user IN users
B baseline ← build(user)
C NEXT user
D print(baselines)
Line B — Each pass overwrites one single baseline, so only the last user's pattern is kept. It should store a separate baseline for each user, as in baselines[user] ← build(user).
Question 3
A history ← logins(user, 0)
B baseline ← typical_hours(history)
C IF now NOT IN baseline THEN
D flag(user)
Line A — Looking back 0 days gives no login history, so there is no data to learn normal login patterns from. It should collect a period of past logins, such as 30 days.
Question 4
A files ← files_used(user, 30)
B typical ← most_common(files)
C baseline['login'] ← typical
D save(baseline)
Line C — The typical files accessed are stored under the wrong key. Typical data access belongs under 'files', so the line should be baseline['files'] ← typical.
Question 5
A hours ← login_hours(user)
B low ← percentile(hours, 5)
C high ← percentile(hours, 5)
D IF hour < low OR hour > high
E flag(user)
Line C — The upper limit of normal login times uses the same 5th percentile as the lower limit. It should use the 95th percentile, percentile(hours, 95), to set the top of the normal range.

Student with a class code? Join your class →