User behaviour analytics: building a baseline

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. What does a user behaviour analytics (UBA) system first build for each user?

A A baseline of how that user normally behaves

B A list of every password the user has ever used

2. Which is an example of a normal login pattern that could form part of a baseline?

A Logging in from an unknown country at 3am

B Logging in from Melbourne between 8am and 5pm on weekdays

3. A baseline in user behaviour analytics is the same for every user in the organisation.

A True: one baseline covers all users

B False: each user has their own baseline

4. Which is typical data access that a baseline might record?

A A payroll officer opens the payroll files each fortnight

B A payroll officer downloads the entire customer database at midnight

5. Why does UBA need to record normal behaviour over time before it can flag anything?

A It needs a baseline to compare new activity against

B It needs to wait until a breach has already happened

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1baseline = {"login_hours": "8am-5pm", "city": "Melbourne"}		ATypical data access recorded over several days to show how many files a user normally opens
2files_per_day = [12, 10, 15, 11]		BA per-user baseline that stores a user's normal login times and location
3A normal login pattern is learned from a user's past logins, such as the usual hours they sign in		CUsing one baseline for all users ignores that each person behaves differently. The baseline must be built per user.
4Each user gets their own baseline, so one user's normal is stored separately from another's		Dusual_hours = ["08:15", "08:30", "08:45"]
5baseline = average_of_all_staff use baseline for every user		EA baseline is built from many normal past logins, not from a single unusual event or a fixed rule.
6if login_hour != 3: build_baseline(user)		Fbaselines["ava"] = {"files": 12}

Definitions

User behaviour analytics

Fill in the Blanks

Complete each line of code by filling in the missing parts.

logins ← getLogins(user, 30) baseline ← _______(logins)

IF loginCountry _ baselineCountry THEN flag("unusual location") END IF

IF filesToday > baselineFiles * 10 THEN ____(user) END IF

FOR EACH user IN staff baseline[____] ← AVERAGE(logins[user]) END FOR

IF loginHour _ baselineEnd THEN flag("late login") END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A user ← 'Ava'

B hours ← login_hours(user, 30)

C baseline ← average(all_users)

D print(baseline)

Question 2

A FOR EACH user IN users

B baseline ← build(user)

C NEXT user

D print(baselines)

Question 3

A history ← logins(user, 0)

B baseline ← typical_hours(history)

C IF now NOT IN baseline THEN

D flag(user)

Question 4

A files ← files_used(user, 30)

B typical ← most_common(files)

C baseline['login'] ← typical

D save(baseline)

Question 5

A hours ← login_hours(user)

B low ← percentile(hours, 5)

C high ← percentile(hours, 5)

D IF hour < low OR hour > high

E flag(user)

Answer Key

User behaviour analytics: building a baseline

Section A: Quick Questions

A — A baseline of how that user normally behaves

B — Logging in from Melbourne between 8am and 5pm on weekdays

B — False: each user has their own baseline

A — A payroll officer opens the payroll files each fortnight

A — It needs a baseline to compare new activity against

Section B: Match the Pairs

baseline = {"login_hours": "8am-5pm", "city": "Melbourne"} → A per-user baseline that stores a user's normal login times and location

files_per_day = [12, 10, 15, 11] → Typical data access recorded over several days to show how many files a user normally opens

A normal login pattern is learned from a user's past logins, such as the usual hours they sign in → usual_hours = ["08:15", "08:30", "08:45"]

Each user gets their own baseline, so one user's normal is stored separately from another's → baselines["ava"] = {"files": 12}

baseline = average_of_all_staff use baseline for every user → Using one baseline for all users ignores that each person behaves differently. The baseline must be built per user.

if login_hour != 3: build_baseline(user) → A baseline is built from many normal past logins, not from a single unusual event or a fixed rule.

Section C: Definitions

User behaviour analytics — Records how each user normally acts, such as login times, locations and files accessed, to build a per-user baseline. Activity that departs from it can be flagged.

Section D: Fill in the Blanks

logins ← getLogins(user, 30)
baseline ← AVERAGE(logins)

IF loginCountry ≠ baselineCountry THEN
  flag("unusual location")
END IF

IF filesToday > baselineFiles * 10 THEN
  flag(user)
END IF

FOR EACH user IN staff
  baseline[user] ← AVERAGE(logins[user])
END FOR

IF loginHour > baselineEnd THEN
  flag("late login")
END IF

Section E: Spot the Error

C — A baseline is built per user. It should average Ava's own login hours (hours), not the hours of all users, otherwise it no longer shows what is normal for Ava.

B — Each pass overwrites one single baseline, so only the last user's pattern is kept. It should store a separate baseline for each user, as in baselines[user] ← build(user).

A — Looking back 0 days gives no login history, so there is no data to learn normal login patterns from. It should collect a period of past logins, such as 30 days.

C — The typical files accessed are stored under the wrong key. Typical data access belongs under 'files', so the line should be baseline['files'] ← typical.

C — The upper limit of normal login times uses the same 5th percentile as the lower limit. It should use the 95th percentile, percentile(hours, 95), to set the top of the normal range.