Functional modeling of the process of detecting user behavior anomalies in corporate information systems

This study addresses the growing challenge of internal threats within complex corporate information systems by developing a functional model for detecting user behavior anomalies. Traditional security measures often prove insufficient against insider risks, necessitating structured approaches like User Behavior Analytics (UBA). The research employs the IDEF0 methodology to systematically formalize the detection process, establishing clear relationships between its core components: inputs (user activity data), controls (security policies), mechanisms (software/hardware and personnel), and outputs (anomaly reports and updated policies). The constructed model is hierarchically decomposed, starting from a contextual diagram (A0) and detailing into four primary functional blocks: Data Processing, Data Adjustment (creating behavioral baselines), Security Policy Configuration, and Anomaly Detection. Data flows between these blocks are formally defined, ensuring sequential information processing and system adaptability. The anomaly detection block is further detailed into sub-processes analyzing event logs, software, devices, and security events. The model’s practical validity was verified through a prototype implementation and experimental testing using scenarios simulating unauthorized access attempts and privilege changes. Results confirmed the correctness of the designed data flows and the model’s applicability for building real-world user behavior analysis systems. The developed functional model provides a structured foundation for designing corporate security systems against internal threats and for further research in user behavior analytics.