Deep Probabilistic Modeling of User Behavior for Anomaly Detection via Mixture Density Networks

2025-05-13

AI Summary

Addressing the challenge of detecting rare, unstructured anomalous patterns in complex user behavior, this paper proposes a conditional probability modeling approach based on Mixture Density Networks (MDNs): a deep neural network parameterizes a Gaussian Mixture Model (GMM) to capture multimodal distributions, and negative log-likelihood serves as a differentiable anomaly scoring function—eliminating reliance on fixed thresholds or unimodal boundary assumptions. This work represents the first systematic application of MDNs to user behavior anomaly detection, leveraging probabilistic density estimation for discriminative decision-making. Evaluated on the UNSW-NB15 dataset, the method consistently outperforms multiple state-of-the-art neural network models, achieving significant improvements in Accuracy, F1-score, and AUC. Moreover, it exhibits markedly reduced training loss fluctuations, demonstrating both superior detection performance and enhanced training stability.

Technology Category

• Data Mining & Knowledge Management: Anomaly/Outlier Detection
• Machine Learning: Calibration & Uncertainty Quantification
• Reasoning under Uncertainty: Relational Probabilistic Models

Application Category

• User Modeling, Personalization and Recommendation: Metrics for user behavior and evaluating success
• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• Web Mining and Content Analysis: Bridging structured and unstructured data

Abstract

To improve the identification of potential anomaly patterns in complex user behavior, this paper proposes an anomaly detection method based on a deep mixture density network. The method constructs a Gaussian mixture model parameterized by a neural network, enabling conditional probability modeling of user behavior. It effectively captures the multimodal distribution characteristics commonly present in behavioral data. Unlike traditional classifiers that rely on fixed thresholds or a single decision boundary, this approach defines an anomaly scoring function based on probability density using negative log-likelihood. This significantly enhances the model's ability to detect rare and unstructured behaviors. Experiments are conducted on the real-world network user dataset UNSW-NB15. A series of performance comparisons and stability validation experiments are designed. These cover multiple evaluation aspects, including Accuracy, F1- score, AUC, and loss fluctuation. The results show that the proposed method outperforms several advanced neural network architectures in both performance and training stability. This study provides a more expressive and discriminative solution for user behavior modeling and anomaly detection. It strongly promotes the application of deep probabilistic modeling techniques in the fields of network security and intelligent risk control.

Problem

• Detects anomalies in complex user behavior patterns
• Models multimodal distribution of behavioral data probabilistically
• Improves detection of rare unstructured behaviors via density networks

Innovation

• Deep mixture density network for anomaly detection
• Gaussian mixture model via neural network
• Anomaly scoring using negative log-likelihood