User behaviour analytics: detecting anomalies

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. A staff member who always logs in from Melbourne at 9am suddenly logs in from overseas at midnight. How does user behaviour analytics treat this?

A It ignores it because the correct password was entered

B It flags it as an anomaly because it departs from their baseline

2. What does an anomaly score (risk score) show in user behaviour analytics?

A How far an action departs from normal and how risky it is

B How many files a user has saved in total

3. An accountant who normally downloads 5 files a day downloads 20,000 files in one hour. Which is the best response?

A Treat it as normal because the user is allowed to access the files

B Give it a high risk score and alert the security team

4. Anomaly detection can help spot a compromised account. Which is true?

A An attacker using stolen credentials often behaves differently from the real user

B An attacker using stolen credentials always behaves exactly like the real user

5. Which activity would most likely be flagged as an insider threat anomaly?

A An employee copying customer records to a USB drive just before resigning

B An employee opening their usual weekly sales report on Monday morning

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1risk_score = 85 # login from new country at 2am		Aif login_hour == 0 and country != home_country: alert('Possible compromised account')
2if downloaded_mb > 5 * baseline_mb: flag(user)		BAn unusual overseas login should raise the risk score, not set it to 0. A score of zero hides a possible compromised account or insider threat.
3A midnight login from overseas by a user who normally works 9-5 in Melbourne is an anomaly that may mean the account is compromised		CFlags an anomaly when a user's download is far larger than their normal amount, a possible insider threat or compromised account
4Each anomaly is given a risk score, and only events at or above a threshold are escalated for review		DThe baseline is set from today's activity, so the current download is compared with itself and the anomaly is never flagged. A baseline must come from the user's past normal behaviour.
5baseline = today_download_mb if download_mb > baseline: flag(user)		Eif risk_score >= 70: escalate(event)
6if login_country != home_country: risk_score = 0		FA high risk score given to activity that departs sharply from the user's normal baseline, so analysts are alerted

Definitions

anomaly detection

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF country __ usual_country THEN risk_score = risk_score + 40 END IF

IF ____________ > baseline_mb * 10 THEN risk_score = risk_score + 30 END IF

IF __________ >= 70 THEN FLAG account AS "compromised" END IF

baseline = _______(past_downloads) difference = today_downloads - baseline IF difference > 500 THEN FLAG "anomaly"

IF hour < 6 __ hour > 22 THEN risk_score = risk_score + 20 END IF

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A risk ← 100

B IF login_country ≠ home

C risk ← risk + 30

D OUTPUT risk

Question 2

A risk ← 0

B IF failed_logins < 5

C risk ← risk + 20

D OUTPUT risk

Question 3

A home ← "AU"

B IF login_country = home

C risk ← risk + 30

D END IF

Question 4

A total ← SUM(past_mb)

B n ← LENGTH(past_mb)

C baseline ← total * n

D OUTPUT baseline

Question 5

A role_files ← files_for(role)

B IF file IN role_files

C risk ← risk + 35

D OUTPUT "Insider alert"

Answer Key

User behaviour analytics: detecting anomalies

Section A: Quick Questions

B — It flags it as an anomaly because it departs from their baseline

A — How far an action departs from normal and how risky it is

B — Give it a high risk score and alert the security team

A — An attacker using stolen credentials often behaves differently from the real user

A — An employee copying customer records to a USB drive just before resigning

Section B: Match the Pairs

risk_score = 85 # login from new country at 2am → A high risk score given to activity that departs sharply from the user's normal baseline, so analysts are alerted

if downloaded_mb > 5 * baseline_mb: flag(user) → Flags an anomaly when a user's download is far larger than their normal amount, a possible insider threat or compromised account

A midnight login from overseas by a user who normally works 9-5 in Melbourne is an anomaly that may mean the account is compromised → if login_hour == 0 and country != home_country: alert('Possible compromised account')

Each anomaly is given a risk score, and only events at or above a threshold are escalated for review → if risk_score >= 70: escalate(event)

baseline = today_download_mb if download_mb > baseline: flag(user) → The baseline is set from today's activity, so the current download is compared with itself and the anomaly is never flagged. A baseline must come from the user's past normal behaviour.

if login_country != home_country: risk_score = 0 → An unusual overseas login should raise the risk score, not set it to 0. A score of zero hides a possible compromised account or insider threat.

Section C: Definitions

anomaly detection — Flagging user behaviour that departs from their normal baseline, such as a midnight overseas login or huge download, and giving it a risk score to spot compromised accounts or insider threats.

Section D: Fill in the Blanks

IF country != usual_country THEN
    risk_score = risk_score + 40
END IF

IF downloads_mb > baseline_mb * 10 THEN
    risk_score = risk_score + 30
END IF

IF risk_score >= 70 THEN
    FLAG account AS "compromised"
END IF

baseline = AVERAGE(past_downloads)
difference = today_downloads - baseline
IF difference > 500 THEN FLAG "anomaly"

IF hour < 6 OR hour > 22 THEN
    risk_score = risk_score + 20
END IF

Section E: Spot the Error

A — The risk score must start at 0 and only go up when an anomaly is found. Starting at 100 would flag every user as high risk. It should be risk ← 0.

B — Many failed logins suggest someone is guessing a password on a possibly compromised account. The test should be failed_logins > 5. Using < would flag normal users instead.

B — An anomaly is a login from somewhere that departs from the baseline. The test should be login_country ≠ home. Using = would add risk for normal logins from the usual country.

C — A baseline of normal behaviour is an average, so the total must be divided by the number of values. It should be baseline ← total / n.

B — An insider threat shows up when someone opens files outside their normal role. The test should be IF file NOT IN role_files. Using IN would flag normal work.