Classification with LSTM Networks in User Behaviour Analytics with Unbalanced Environment

The paper describes the proposed approach for classification in an unbalanced class environment and demonstrates it in the context of an anomaly detection system in user behaviour. The proposed approach is aimed on lessening the number of false-negative cases – cases, when an anomaly was recognized as normal event. The proposed approach is based on implementing LSTM neural network; it includes pre-processing flow data and splitting it into subsets by the user groups and training individual LSTM network for each group. The proposed approach was tested by experimenting with different neural network types and structures, as also testing in balanced and unbalanced class environments, including testing with and without LSTM network.