← VCE Data Analytics U4O2

User behaviour analytics: detecting anomalies

Flagging user behaviour that departs from their normal baseline, such as a midnight overseas login or huge download, and giving it a risk score to spot compromised accounts or insider threats.

Part of: VCE Data Analytics - U4O2 - Cyber Security: Data Security — Module 135

Understanding User behaviour analytics: detecting anomalies in VCE Data Analytics U4O2

What it does: The code tests for a time and location that depart from the user's baseline, which is the anomaly pattern for a compromised account. Scoring lets analysts focus on the riskiest anomalies by escalating only those that reach the threshold. UBA compares activity to the user's normal baseline. A midnight overseas login is unusual, so it is flagged even if the password was right. A risk score rates how unusual and risky behaviour is. Higher scores get investigated first. Attackers usually log in at odd times, from odd places or access unusual data. This shows up as a departure from the baseline.

Common mistakes: The risk score must start at 0 and only go up when an anomaly is found. Starting at 100 would flag every user as high risk. It should be risk ← 0. Many failed logins suggest someone is guessing a password on a possibly compromised account. The test should be failed_logins > 5. Using < would flag normal users instead.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add User behaviour analytics: detecting anomalies to a class →

This module's key terms are also in a printable crossword (Modules 135–150) and word search (Modules 115–150).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
A staff member who always logs in from Melbourne at 9am suddenly logs in from overseas at midnight. How does user behaviour analytics treat this?
It ignores it because the correct password was enteredIt flags it as an anomaly because it departs from their baseline
Matches
baseline = today_download_mb if download_mb > baseline: flag(user)
↓
The baseline is set from today's activity, so the current download is compared with itself and the anomaly is never flagged. A baseline must come from the user's past normal behaviour.
Applying
Meanings
Term
anomaly detection
Meaning
Flagging user behaviour that departs from their normal baseline, such as a midnight overseas login or huge download, and giving it a risk score to spot compromised accounts or insider threats.
Practice
risk ← 0
Testing
Gaps
IF country usualcountry THEN
Check Answer
Spots
1risk ← 100
2IF login_country ≠ home

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Wolverine' badge — Fearless Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. A staff member who always logs in from Melbourne at 9am suddenly logs in from overseas at midnight. How does user behaviour analytics treat this?
A. It ignores it because the correct password was entered
B. It flags it as an anomaly because it departs from their baseline ✓
UBA compares activity to the user's normal baseline. A midnight overseas login is unusual, so it is flagged even if the password was right.
2. What does an anomaly score (risk score) show in user behaviour analytics?
A. How far an action departs from normal and how risky it is ✓
B. How many files a user has saved in total
A risk score rates how unusual and risky behaviour is. Higher scores get investigated first.
3. An accountant who normally downloads 5 files a day downloads 20,000 files in one hour. Which is the best response?
A. Treat it as normal because the user is allowed to access the files
B. Give it a high risk score and alert the security team ✓
A huge download departs sharply from the baseline. It could be a compromised account or an insider threat, even though the user has permission.
4. Anomaly detection can help spot a compromised account. Which is true?
A. An attacker using stolen credentials often behaves differently from the real user ✓
B. An attacker using stolen credentials always behaves exactly like the real user
Attackers usually log in at odd times, from odd places or access unusual data. This shows up as a departure from the baseline.
5. Which activity would most likely be flagged as an insider threat anomaly?
A. An employee copying customer records to a USB drive just before resigning ✓
B. An employee opening their usual weekly sales report on Monday morning
Unusual copying of sensitive data is a departure from normal behaviour, so it gets a higher risk score. Opening a usual report matches the baseline.

Match the Pairs

risk_score = 85 # login from new country at 2am → A high risk score given to activity that departs sharply from the user's normal baseline, so analysts are alerted
if downloaded_mb > 5 * baseline_mb: flag(user) → Flags an anomaly when a user's download is far larger than their normal amount, a possible insider threat or compromised account
A midnight login from overseas by a user who normally works 9-5 in Melbourne is an anomaly that may mean the account is compromised → if login_hour == 0 and country != home_country: alert('Possible compromised account')
Each anomaly is given a risk score, and only events at or above a threshold are escalated for review → if risk_score >= 70: escalate(event)
baseline = today_download_mb if download_mb > baseline: flag(user) → The baseline is set from today's activity, so the current download is compared with itself and the anomaly is never flagged. A baseline must come from the user's past normal behaviour.
if login_country != home_country: risk_score = 0 → An unusual overseas login should raise the risk score, not set it to 0. A score of zero hides a possible compromised account or insider threat.

Key Term

anomaly detection
Flagging user behaviour that departs from their normal baseline, such as a midnight overseas login or huge download, and giving it a risk score to spot compromised accounts or insider threats.

Fill in the Blanks

1. IF country != usual_country THEN risk_score = risk_score + 40 END IF
Hint: Type the comparison operator that checks whether two values are not equal, so an overseas login is spotted.
2. IF downloads_mb > baseline_mb * 10 THEN risk_score = risk_score + 30 END IF
Hint: Type the variable that holds the size of today's download, which is compared against the user's baseline.
3. IF risk_score >= 70 THEN FLAG account AS "compromised" END IF
Hint: Type the variable that holds the running risk total for the user's activity.
4. baseline = AVERAGE(past_downloads) difference = today_downloads - baseline IF difference > 500 THEN FLAG "anomaly"
Hint: Type the function that works out the user's usual (mean) value from past activity.
5. IF hour < 6 OR hour > 22 THEN risk_score = risk_score + 20 END IF
Hint: Type the logical operator that flags a login if either the too-early or the too-late condition is true.

Spot the Error

Question 1
A risk ← 100
B IF login_country ≠ home
C risk ← risk + 30
D OUTPUT risk
Line A — The risk score must start at 0 and only go up when an anomaly is found. Starting at 100 would flag every user as high risk. It should be risk ← 0.
Question 2
A risk ← 0
B IF failed_logins < 5
C risk ← risk + 20
D OUTPUT risk
Line B — Many failed logins suggest someone is guessing a password on a possibly compromised account. The test should be failed_logins > 5. Using < would flag normal users instead.
Question 3
A home ← "AU"
B IF login_country = home
C risk ← risk + 30
D END IF
Line B — An anomaly is a login from somewhere that departs from the baseline. The test should be login_country ≠ home. Using = would add risk for normal logins from the usual country.
Question 4
A total ← SUM(past_mb)
B n ← LENGTH(past_mb)
C baseline ← total * n
D OUTPUT baseline
Line C — A baseline of normal behaviour is an average, so the total must be divided by the number of values. It should be baseline ← total / n.
Question 5
A role_files ← files_for(role)
B IF file IN role_files
C risk ← risk + 35
D OUTPUT "Insider alert"
Line B — An insider threat shows up when someone opens files outside their normal role. The test should be IF file NOT IN role_files. Using IN would flag normal work.

Student with a class code? Join your class →