User Login Behaviour Analysis in HPC clusters using Data Analysis and Probabilistic Technique

Abstract

The login behaviour of users in HPC clusters will be examined in this research paper with the use of machine learning, data analysis and probabilistic techniques to identify patterns that can be used to identify anomalous login behaviour based on IP and timings. The customized probabilistic model will monitor each user's login behaviour and stop any unauthorized activity in HPC clusters.This paper also discusses the data preprocessing and feature engineering techniques to extract information from sshd logs. Despite several attempts to utilize machine learning models to recognize and save user patterns from sshd logs, the majority of the models proved unsuccessful. Since the sshd logs do not exhibit any distinct login behaviour or pattern of users, machine learning models trained on specific behaviour or patterns from datasets struggle to detect even slight changes in user login behaviour, resulting in a high rate of failure for such models. One major factor contributing to the failure of machine learning models is the highly imbalanced dataset consisting solely of true values, which makes it challenging for the models to identify outliers or patterns. Additionally, since the users do not follow any specific pattern, it may be necessary to establish a single pattern and categorize the login behaviour of all users accordingly to achieve successful results. To overcome the challenges of identifying user login patterns and detecting anomalies, an automated approach is necessary. This approach should involve the development of a system that can detect and store each user's login patterns as probability metrics along with IP addresses. These metrics can then be utilized to predict any anomalous activity based on the identified patterns