Behavior Analysis¶
The behavior analysis tool processes monitoring data for users sessions, builds behavior models from the sessions and clusters these behaviors utilizing MTree and DBScan.
Details on the implementation can be found in Lars Jürgensen’s thesis and in the article A Journey to comprehensible User Behavior Models.
Usage¶
The tool uses a configuration file, i.e., it is called with
behavior-analysis -c configuration.conf
.
Configuration File¶
The configuration file may have the following settings:
Parameter |
Description |
---|---|
clusterOutputPath |
file path for the result clusters |
medoidOutputPath |
directory path for all medoids |
classSignatureAcceptancePatternFile |
acceptance patterns for class names in events. |
operationSignatureAcceptancePatternFile |
acceptance patterns for operation signatures in events. |
acceptanceMatcherMode |
define how event matches should be handled: normal or inverse. |
traceSignatureProcessor |
|
clusteringDistance |
|
minPts |
|
maxAmount |
|
userSessionTimeout |
|
nodeInsertCost |
node insertion cost for the graph edit distance |
edgeInsertCost |
edge insertion cost for the graph edit distance |
eventGroupInsertCost |
cost for event groups |
parameterWeighting |
when events contain payloads, these can be included when calculating the GED. Default is NaiveParameterWeighting which ignores the payload. |
directories |
one or more Kieker log directories, separated by a path separator (:/; on unix/windows) |
dataBufferSize |
read file buffer size |
verbose |
if set be more verbose regarding the analysis. |
The classSignatureAcceptancePatternFile and operationSignatureAcceptancePatternFile contain Java regular expressions to match class and operation signatures in BeforeOperationEvents.