Behavior shifts

Behavior Shifts is a separate, complementary detection layer that runs alongside the rule-based heuristics. Instead of looking for specific known-bad actions, it uses statistical change-point detection to ask: did this user’s overall activity pattern change significantly at some point in the dataset? A shift does not automatically indicate malicious activity, but it narrows the investigation window — you know exactly when the pattern changed and can review events around that bucket.

Algorithm

The engine uses Binary Segmentation with an F-statistic significance test (p < 0.05). For each user, it aggregates events into time buckets, then recursively splits the series at the point that maximises the reduction in sum-of-squared residuals. Each candidate split is validated with an F-test (H0: single mean across the whole segment; H1: two distinct means). Splits that do not meet the significance threshold are discarded. Recursion continues on both halves until no more significant splits are found or the segment is too short (minimum 3 buckets per side). Each detected change point is then reclassified into one of three types and assigned a confidence level (low / medium / high) derived from the F-test p-value.

Level Shift

The mean activity count changed sustainably between two consecutive segments — e.g. a user who averaged 5 events/bucket suddenly sustains 40 events/bucket. Magnitude is expressed as the signed percentage change between the two means: ((afterMean − beforeMean) / beforeMean) × 100. A negative magnitude means the user went quiet; positive means a spike. This is the most common shift type and covers both exfiltration ramp-ups and sudden account dormancy after a password reset.

Formula

F-test: F = MSR / MSE where MSR = SSR_full − SSR_split (df=1), MSE = SSR_split / (n−2). Magnitude = ((μ_after − μ_before) / μ_before) × 100. Confidence from p-value threshold: high p<0.001, medium p<0.01, low p<0.05.

Trend Change

Rather than a step change in the mean, the slope of the series changed direction or acceleration. After Binary Segmentation identifies a candidate split, a Welch’s t-test compares the linear regression slopes on either side. If the slope difference dominates the level difference and is statistically significant, the point is reclassified from level_shift to trend_change. Typical examples: a steady linear ramp-up in data access that suddenly reverses (V-shape), or an accelerating download rate that abruptly plateaus.

Formula

Welch's t-test on slopes: t = |b_before − b_after| / √(SE_before² + SE_after²) where b = least-squares slope and SE = slope standard error. Reclassified from level_shift when slopeDiff > levelDiff and p < 0.05.

Volatility Shift

The mean activity is similar on both sides of the split but the variance changed significantly — the user became either erratic (bursty) or unusually consistent. Detected with an F-test for equality of variances (Levene-style) across adjacent segments identified by Binary Segmentation. To avoid false positives on noisy low-activity series, volatility shifts are only reported when the level difference is less than 30% of the segment mean. Magnitude is expressed as the variance ratio: afterVariance / beforeVariance.

Formula

F = Var(after) / Var(before) — two-tailed F-test for equality of variances (Levene-style). Confidence from p-value threshold: high p<0.001, medium p<0.01, low p<0.05.

Spike

Flags isolated buckets where activity is unusually high relative to the user’s baseline, without requiring a sustained change. The z-score measures how many standard deviations above the user’s overall mean the bucket falls. To avoid double-flagging, spikes are suppressed if a level_shift or other change point already exists within ±1 bucket. Magnitude is the z-score itself. This type is complementary to level_shift: it catches one-off events (mass download, sudden exfiltration attempt) that do not alter the long-term mean.

Formula

z = (x_i − μ) / σ — where μ and σ are the mean and standard deviation of the full user series. Threshold: z ≥ 2.5. Confidence: high z≥4, medium z≥3, low z≥2.5. p-value approximated via Abramowitz & Stegun normal survival function.