Random forests for profiling computer network users

Abstract

In this paper, we present a novel system to detect abnormal behaviour of computer network users based on features of web pages which were requested by a user (e.g. URL address, URL category, the day of week or time when the web page was visited). There are many causes of an abnormal behaviour of network users e.g. a computer can be infected by a virus or a Trojan, a stranger can take control of a computer system, etc. Thus, the proposed system can be a very important security mechanism in networks. The system can be also used to make personal user profiles. We use the bag-of-words model to analyse the text data from firewall logs from 63 users collected over a one and half month period. The 500 GB of the network traffic meta-data allowed to achieve satisfactory classification accuracy.