FP-Growth based Regular Behaviors Auditing in Electric Management Information System

In Electric Management Information System (MIS), there are some users who do not comply with all operation/behavior regulations and make the similar mistakes continuously even though they are not on purpose. These behaviors are a huge threat to the system security. In this paper, we propose a method to detect these regular behaviors with association rules mining algorithm FP-Growth. First, the user log is separated into operation sets each of which contains user operation in a continuous period. Then we divide the operation sets of all users into two catalogs: normal and abnormal based on if a security problem has happened around the corresponding period of operation set. Next, we apply the FP-Growth algorithm in both normal and abnormal operation sets to generate the frequent patterns. Finally, the abnormal pattern is compared with normal ones to determine the regular behaviors that may be dangerous to the system. We test the proposed algorithm in the user log files generated from a simulated electric management information system. The experiment results indicate the proposed method can effectively detect the regular user behavior that could cause the system security problems.