| | | 1 | | using Intentum.Core.Behavior; |
| | | 2 | | |
| | | 3 | | namespace Intentum.Core.UBA; |
| | | 4 | | |
| | | 5 | | /// <summary> |
| | | 6 | | /// Tracks a user's baseline behavior for deviation detection. |
| | | 7 | | /// </summary> |
| | | 8 | | public sealed class UserProfile |
| | | 9 | | { |
| | 0 | 10 | | public string UserId { get; } |
| | 0 | 11 | | public DateTimeOffset CreatedAt { get; } |
| | 10 | 12 | | public int TotalSessions { get; private set; } |
| | 31 | 13 | | public Dictionary<string, int> ActionFrequency { get; } = new(StringComparer.OrdinalIgnoreCase); |
| | 13 | 14 | | public List<DateTimeOffset> ActivityTimestamps { get; } = []; |
| | | 15 | | |
| | 5 | 16 | | public UserProfile(string userId) |
| | 5 | 17 | | { |
| | 5 | 18 | | UserId = userId ?? throw new ArgumentNullException(nameof(userId)); |
| | 4 | 19 | | CreatedAt = DateTimeOffset.UtcNow; |
| | 4 | 20 | | } |
| | | 21 | | |
| | | 22 | | /// <summary> |
| | | 23 | | /// Learns from a behavior space, updating the baseline profile. |
| | | 24 | | /// </summary> |
| | | 25 | | public void Learn(BehaviorSpace space) |
| | 3 | 26 | | { |
| | 3 | 27 | | TotalSessions++; |
| | 25 | 28 | | foreach (var evt in space.Events) |
| | 8 | 29 | | { |
| | 8 | 30 | | ActionFrequency.TryGetValue(evt.Action, out var count); |
| | 8 | 31 | | ActionFrequency[evt.Action] = count + 1; |
| | 8 | 32 | | ActivityTimestamps.Add(evt.OccurredAt); |
| | 8 | 33 | | } |
| | 3 | 34 | | } |
| | | 35 | | |
| | | 36 | | /// <summary> |
| | | 37 | | /// Calculates a deviation score [0-1] between the current behavior and the baseline. |
| | | 38 | | /// Higher values indicate more unusual behavior. |
| | | 39 | | /// </summary> |
| | | 40 | | public double CalculateDeviation(BehaviorSpace currentSpace) |
| | 3 | 41 | | { |
| | 3 | 42 | | if (TotalSessions == 0 || ActionFrequency.Count == 0) |
| | 1 | 43 | | return 0; |
| | | 44 | | |
| | 2 | 45 | | var totalActions = ActionFrequency.Values.Sum(); |
| | 2 | 46 | | var unknownActionCount = 0; |
| | 2 | 47 | | var knownActionDeviation = 0.0; |
| | | 48 | | |
| | 14 | 49 | | foreach (var evt in currentSpace.Events) |
| | 4 | 50 | | { |
| | 4 | 51 | | if (!ActionFrequency.TryGetValue(evt.Action, out var baselineCount)) |
| | 2 | 52 | | { |
| | 2 | 53 | | unknownActionCount++; |
| | 2 | 54 | | continue; |
| | | 55 | | } |
| | | 56 | | |
| | 2 | 57 | | var normalizedBaseline = baselineCount / (double)totalActions; |
| | 2 | 58 | | knownActionDeviation += Math.Abs(1.0 / currentSpace.Events.Count - normalizedBaseline); |
| | 2 | 59 | | } |
| | | 60 | | |
| | 2 | 61 | | if (currentSpace.Events.Count == 0) |
| | 0 | 62 | | return 0; |
| | | 63 | | |
| | 2 | 64 | | var unknownRatio = unknownActionCount / (double)currentSpace.Events.Count; |
| | 2 | 65 | | var deviation = (unknownRatio * 0.7) + (Math.Min(knownActionDeviation, 1.0) * 0.3); |
| | | 66 | | |
| | 2 | 67 | | return Math.Clamp(deviation, 0, 1); |
| | 3 | 68 | | } |
| | | 69 | | } |