# Behavioral Intruder Detection Based on Browsing Patterns with Automated Grouping of Requested Webpages

## TL;DR

This paper introduces a method for detecting online fraud by analyzing browsing patterns using web-server logs and a Siamese neural network, improving accuracy and scalability in fraud detection.

## Contribution

The novel automated grouping of webpages using low-rank approximation enhances classification accuracy and reduces manual analysis in fraud detection.

## Key findings

- A Siamese neural network achieves 90% accuracy in classifying web sessions from the same user.
- Automated grouping of requested pages improves classification accuracy and reduces manual log analysis.
- Experiments on real-world intranet weblogs highlight challenges in data filtering and aggregation for fraud detection.

## Abstract

Impersonation attacks causing online fraud are a growing challenge for digital services, demanding the integration of biometric and behavioral factors into traditional authentication methods. Behavioral impersonation detection during online sessions is particularly critical for online banking, and the existing solutions focus mostly on mouse and keyboard dynamics. We study behavioral patterns extracted from standard web-server logs and claim that our methods are applicable in a banking scenario. Using a Siamese neural network, we classify pairs of web sessions from the same user with 90% accuracy. Experiments conducted on real-world intranet weblogs, serving as a proxy for banking data, highlight challenges in filtering and aggregating data. To address variability in website technologies and browsing behaviors, we introduce an automated procedure for grouping requested pages based on a low-rank approximation of the user browsing matrix. This approach consistently improves classification accuracy while reducing reliance on costly, error-prone manual log analysis, offering a scalable, viable approach for fraud detection in online services.