User Behavior Auditing in Electric Management Information System based on Graph Clustering

In this paper, we propose a user behavior auditing algorithm based on graph clustering. First, we record the user operations in the electric management information system (MIS) and convert the log data into graph representation which includes not only the operation itself but also the source and next step. Then the user log graph will be divided into sub-graphs with strong inner connections, which stand for a continuous or specific user behavior. Next, the distance between behavior graphs is defined based on their similarity. Finally, the clustering algorithm is applied in the behavior graphs to detect the abnormal behavior. The experiment shows that the proposed method can effectively detect the abnormal behavior in a simulated electric company management information system.