Search

Die Identifikation von Sessions zum Verständnis des Benutzerverhaltens ist ein Forschungsgebiet des Web Usage Mining. Definitionen und Konzepte werden seit über 20 Jahren diskutiert. Die Forschung zeigt, dass Session-Identifizierung kein willkürlicher Prozess sein sollte. Es gibt eine fragwürdige Tendenz zu vereinfachten mechanischen Sessions anstelle logischer Segmentierungen. Ziel der Dissertation ist es zu beweisen, wie unterschiedliche Session-Ansätze zu abweichenden Ergebnissen und Interpretationen führen. Die übergreifende Forschungsfrage lautet: Werden sich verschiedene Ansätze zur Session-Identifizierung auf Analyseergebnisse und Machine-Learning-Probleme auswirken? Ein methodischer Rahmen für die Durchführung, den Vergleich und die Evaluation von Sessions wird gegeben. Die Dissertation implementiert 135 Session-Ansätze in einem Jahr (2018) Daten einer deutschen Preisvergleichs-E-Commerce-Plattform. Die Umsetzung umfasst mechanische Konzepte, logische Konstrukte und die Kombination mehrerer Mechaniken. Es wird gezeigt, wie logische Sessions durch Embedding-Algorithmen aus Benutzersequenzen konstruiert werden: mit einem neuartigen Ansatz zur Identifizierung logischer Sessions, bei dem die thematische Nähe von Interaktionen anstelle von Suchanfragen allein verwendet wird. Alle Ansätze werden verglichen und quantitativ beschrieben sowie in drei Machine-Learning-Problemen (wie Recommendation) angewendet. Der Hauptbeitrag dieser Dissertation besteht darin, einen umfassenden Vergleich von Session-Identifikationsalgorithmen bereitzustellen. Die Arbeit bietet eine Methodik zum Implementieren, Analysieren und Evaluieren einer Auswahl von Mechaniken, die es ermöglichen, das Benutzerverhalten und die Auswirkungen von Session-Modellierung besser zu verstehen. Die Ergebnisse zeigen, dass unterschiedlich strukturierte Eingabedaten die Ergebnisse von Algorithmen oder Analysen drastisch verändern können. The identification of sessions as a means of understanding user behaviour is a common research area of web usage mining. Different definitions and concepts have been discussed for over 20 years: Research shows that session identification is not an arbitrary task. There is a tendency towards simplistic mechanical sessions instead of more complex logical segmentations, which is questionable. This dissertation aims to prove how the nature of differing session-identification approaches leads to diverging results and interpretations. The overarching research question asks: will different session-identification approaches impact analysis and machine learning tasks? A comprehensive methodological framework for implementing, comparing and evaluating sessions is given. The dissertation provides implementation guidelines for 135 session-identification approaches utilizing a complete year (2018) of traffic data from a German price-comparison e-commerce platform. The implementation includes mechanical concepts, logical constructs and the combination of multiple methods. It shows how logical sessions were constructed from user sequences by employing embedding algorithms on interaction logs; taking a novel approach to logical session identification by utilizing topical proximity of interactions instead of search queries alone. All approaches are compared and quantitatively described. The application in three machine-learning tasks (such as recommendation) is intended to show that using different sessions as input data has a marked impact on the outcome. The main contribution of this dissertation is to provide a comprehensive comparison of session-identification algorithms. The research provides a methodology to implement, analyse and compare a wide variety of mechanics, allowing to better understand user behaviour and the effects of session modelling. The main results show that differently structured input data may drastically change the results of algorithms or analysis.

Social networks have recently emerged to become vital tools for information and content dissemination among connections. Indeed, the immense increase of the number of users of Facebook made it rise to become the largest existing social network with more than 1.2 billion active users. However, these numbers also rose the attention of hackers and attackers who aim at propagating malware and viruses for obtaining confidential information regarding social network users. In this manner, it is crucial that each Facebook user is able to easily access, control and analyse the information shared on the corresponding profile so that profile usage deviations can be more efficiently detected. However, despite the fact that Facebook allows an analysis of all user actions through the Timeline Review, this information is not comprehensively organized and there is no statistical analysis of the user generated data. In this paper, we propose a novel framework comprising a Facebook event collector, which by being provided with an authentication token for a user profile obtained through a Facebook application developed for this purpose, collects all the corresponding posted information and stores it in a relational database for a posteriori analysis. Through the graphical interface of the developed application, users can access all stored information in a comprehensible manner, according to the type of event, thus facilitating the analysis of the user's behaviour. By storing each event with the corresponding timestamp, we are able to perform an efficient and comprehensive analysis of all posted contents and compute statistical models over the obtained data. In this manner, we can create a notion of normal usage profile and detect possible deviations which may be indicative of a compromised user account.

While network traffic characteristics of Massively Multiplayer Online Role-Playing Games (MMORPG) are known to be very variable and somehow linked to game dynamics and user behaviour, the actual relationships have, thus far, not been described in a comprehensive and unified way, which could sucessfully be applied for synthetic traffic generation. This thesis aims to fill this gap by proposing a novel source based MMORPG traffic model, which explains and captures observed variations of traffic characteristics. The proposed model takes user behaviour at the application level as a starting point. As networked virtual worlds of MMORPGs are very complex, there is a wide variety of in-game situations based on “what users do” in the virtual world, which reflect onto network traffic in different ways. The model focuses on capturing, recognizing, understanding, and describing the relationships between user actions and network traffic. A classification proposed in this thesis distinguishes between the following user action categories: Trading, Questing, Player versus player combat, Dungeons, and Raiding. For each action category, a traffic model capturing the statistical characteristics of network traffic has been developed and validated through network traffic measurements. Client and server application protocol data unit size and interrarival time have been modeled by a combination of several distributions, including Weibull, Normal, Lognormal, Largest Extreme Value, and Deterministic. Next, the player behaviour over a sin-gle gaming session has been studied and modelled based on the defined action categories by using a first order Markov chain. Finally, the aggregate behaviour of all active users on a single MMORPG server has been described. The arrival of new players and departure of leaving players are modeled as a Homogeneous Poisson Process (HPP). Based on the proposed model, a functional architecture of a MMORPG traffic generator based on player behaviour, called UrBBaN-Gen, has been developed and implemented by using Java, Python and bash scripts, together with the open source software traffic generator – Distributed Internet Traffic Generator (D-ITG). Synthetic traffic generated by UrBBaN-Gen has been compared with independent empirical traces, and it has been demonstrated that the characteristics of the generated traffic closely follow the real traffic. Also, the model has been compared with the models found in literature, and its advantages over the existing models have been shown. The contribution of this thesis may be summarized as follows: Classification of user actions in the virtual world of MMORPGs, and characterization of associated network traffic ; User behaviour model based on categories of user actions, motivational parameters, and identified behavioural patterns on application level ; and Architecture and implementation of traffic generator based on the model and verification of the model through comparison of synthetic and real traffic. Karakteristike mrežnog prometa koji generiraju višekorisničke igre s preuzimanjem uloga su vrlo promjenjive. Varijacije u mrežnom opterećenju mogu dostizati i razliku od deset puta između najniže i najviše vrijednosti. Treba uzeti u obzir da je riječ o prosječnim vrijednostima u vremenskim periodima na razini minuta, pa čak i sati. U ovoj disertaciji predložen je izvorišni model mrežnog prometa. Izvorišni modeli mrežnog prometa temelje se na ponašanju aplikacija koje se nalaze na krajnjim točkama mreže. Predloženi model objašnjava i obuhvaća uočene varijacije karakteristika mrežnog prometa. Model se temelji na ponašanju korisnika unutar višekorisničkih igara s preuzimanjem uloga. Kao studijski slučaj koristi se umrežena igra World of Warcraft proizvođača Activision Blizzard. Kako su virtualni svjetovi ovih igara vrlo složeni, a broj interakcija i situacija u kojem se korisnik može naći velik, za potrebe modeliranja predložena je klasifikacija korisničkih akcija. Predložene kategorije korisničkih akcija su: trgovanje, traganje ili izvršavanje zadataka, borba između igrača, napadanje tamnica i masovno napadanje tamnica. Različitost identificiranih kategorija ponašanja potvrđena je kroz mjerenje i usporedbu karakteristika mrežnog prometa pojedinačne kategorije. Za svaku kategoriju kreiran je matematički model mrežnog prometa koji se sastoji od kompleksnih statističkih distribucija koje opisuju veličinu jedinica podataka koji se šalju na razini aplikacije (ne na razini, primjerice, datagrama protokola IP), te međudolazna vremena između dva uzastopna slanja jedinica podataka. Na temelju identificiranih kategorija provedena su mjerenja ponašanja korisnika pomoću kojih je kreiran model ponašanja korisnika. Kreirani model opisuje ponašanje pojedinačnog korisnika, ali i zbirno ponašanje svih korisnika na razini usluge. Također, proučen je odnos između psihološke motivacije korisnika i njihovog ponašanja na razini aplikacije. Razvijeni modeli ponašanja korisnika i njihov utjecaj na mrežne karakteristike prometa objedinjeni su kroz funkcijsku arhitekturu programskog generatora mrežnog prometa utemeljenog na ponašanju korisnika (engl. User Behaviour Based Network Traffic Generator - UrBBaN-Gen.). UrBBaN-Gen čine tri programska modula: 1) simulator korisničkog ponašanja, 2) sustav za kontrolu distribuiranog generiranja prometa te 3) generator mrežnog prometa. Simulator korisničkog ponašanja razvijen je primjenom programskog jezika Java, a sustav za kontrolu distribuiranog generiranja prometa primjenom Jave te Python i Bash skripti. Generator mrežnog prometa temelji se na softveru otvorenog koda Distribuirani internetski mrežni generator (engl. Distributed Internet Traffic Generator -- D-ITG), koji je modificiran kako bi se u njega ugradili modeli prometa predloženih kategorija korisničkih akcija. Razvijeni model mrežnog prometa je uspoređen s modelima za istu uslugu poznatima u literaturi te su pokazane njegove prednosti. Također, model je verificiran kroz usporedbu sintetičkog, računalno generiranog prometa sa stvarnim prometom, te je pokazano da karakteristike generiranog prometa zadovoljavajuće sliče karakteristikama stvarnog prometa. Znanstveni doprinos disertacije je sljedeći: 1. Klasifikacija tipova korisničkih akcija unutar virtualnih okruženja igara s preuzimanjem uloga i karakterizacija pripadajućeg mrežnog prometa, 2. Model ponašanja korisnika, temeljen na kategorijama korisničkih akcija, motivacijskim parametrima te identificiranim uzorcima ponašanja na razini aplikacije, i 3. Arhitektura i programska izvedba generatora mrežnog prometa zasnovanog na modelu i verifikacija modela kroz usporedbu sintetiziranog i stvarnog mrežnog prometa.