Deep Probabilistic Modeling of User Behavior for Anomaly Detection via Mixture Density Networks

TL;DR

This paper introduces a deep mixture density network for anomaly detection in user behavior data, effectively modeling complex distributions and outperforming existing methods in stability and accuracy.

Contribution

It presents a novel deep probabilistic model that captures multimodal user behavior distributions for improved anomaly detection.

Findings

Outperforms existing neural network models in accuracy and stability.

Effectively detects rare and unstructured user behaviors.

Validated on real-world network dataset UNSW-NB15.

Abstract

To improve the identification of potential anomaly patterns in complex user behavior, this paper proposes an anomaly detection method based on a deep mixture density network. The method constructs a Gaussian mixture model parameterized by a neural network, enabling conditional probability modeling of user behavior. It effectively captures the multimodal distribution characteristics commonly present in behavioral data. Unlike traditional classifiers that rely on fixed thresholds or a single decision boundary, this approach defines an anomaly scoring function based on probability density using negative log-likelihood. This significantly enhances the model's ability to detect rare and unstructured behaviors. Experiments are conducted on the real-world network user dataset UNSW-NB15. A series of performance comparisons and stability validation experiments are designed. These cover multiple evaluation aspects, including Accuracy, F1- score, AUC, and loss fluctuation. The results show that the proposed method outperforms several advanced neural network architectures in both performance and training stability. This study provides a more expressive and discriminative solution for user behavior modeling and anomaly detection. It strongly promotes the application of deep probabilistic modeling techniques in the fields of network security and intelligent risk control.