Profiling User Behavior for Intrusion Detection Using Item Response Modeling

Item response theory (IRT) is a modern test measurement theory that has been widely used in many research areas over the last decade. This paper presents an IRT modeling approach that fits network traffic to a “test” (normal or abnormal) model and estimates an expected test score of being anomaly-free to profile user behavior. With four anomaly-free associated variables identified from previous studies, the findings demonstrate that there is a remarkable difference in item characteristic curves between the user behavior patterns with anomalies and those that are anomaly-free, and such a difference can be quantitatively measured with the expected test score ranging from 0 to 100 where a high score is more likely to be associate with an anomaly-free pattern. More specifically, there are approximately 25 (SD = 4.0) points’ differences between a pattern with anomalies and one without. Our study demonstrates the potential feasibility and achievability of applying IRT for modern network security.