A method, system, and apparatus comprising a computer program encoded on a computer storage medium for classifying user behavior as abnormal. One of the methods includes obtaining user behavior data representing user behavior in the subject system. An initial model is generated from the training data. The initial model has a first characteristic feature of the training data. A resampling model is generated from the training data and from multiple instances of the first display for the test period. The difference between the initial model and the resampling model is calculated. Based on the difference between the initial model and the resampling model, the user behavior during the test period is classified as abnormal.
展开▼
