Intelligent Agents in Cybersecurity: Deep Learning to Analyze User Behavior Applying

Abstract

The research aim is to develop an intelligent agent for cybersecurity systems capable of detecting abnormal user behavior using deep learning methods and ensuring interpretability of decisions. A four-module architecture is proposed: log collection and aggregation, behavioral feature generation, analysis using the Long Short-Term Memory (LSTM) + Attention model, and an interpretation module. A hybrid approach is used that combines log processing, temporal neural networks and an attention mechanism to identify significant actions in the behavioral chain. Testing was conducted on the Computer Emergency Response Team (CERT) and the Australian Defence Force Academy Linux Dataset (ADFA-LD) datasets. The developed system demonstrated high accuracy rates (ROC-AUC > 0.95), as well as superiority over classical and modern models (Logistic Regression, Random Forest, and Autoencoder). The attention mechanism ensured interpretability: it became possible to visually determine which user actions caused the alarm. A method for preparing logs and forming training samples is proposed. The intelligent agent can be integrated into corporate Security Information and Event Management (SIEM)/User and Entity Behavior Analytics (UEBA) systems, used in monitoring centers and applied in educational practice. Scientific novelty is manifested in the architecture, the use of attention in logs and interpretable behavior analysis in real time.