Current state and trends in agentless profiling of user behavior based on network telemetry
DOI:
https://doi.org/10.34185/1562-9945-5-166-2026-03Keywords:
cybersecurity, NetFlow, IPFIX, user behaviour, user identity, UEBA, behavioural quantificationAbstract
The relevance of this research topic stems from the rapid pace of digitalization and the need to detect anomalous or malicious activity in corporate networks without violating user privacy or overloading the IT infrastructure. The problem lies in the significant methodological fragmentation of existing approaches to behavioural analysis, as well as in the strict technical and organizational limitations of traditional agent–based endpoint monitoring tools.
The objective of the study is to systematize and comprehensively analyse the scientific and technical body of work in the field of agentless modelling of digital activity to determine the current state, technological capabilities, and limitations of using network telemetry (in particular, NetFlow/IPFIX) for user profiling and the detection of anomalous behaviour without infringing on user privacy.
The research methods are based on a simplified systematic literature review (SLR) covering the period from 2010 to 2025, in accordance with the methodological recommendations of B. Kitchenham and S. Charters in the field of computer engineering. Following a step–by–step screening procedure and expert evaluation, a representative pool of 25 key works was selected from the initially identified 121 publications for quantitative and qualitative meta–analysis.
Results and Key Findings. An original diagram of the evolution of cybersecurity technologies was developed, demonstrating a logical engineering transition from reactive, signature–based detection of known threats on hosts to proactive, context– and behaviour–based orchestration based on integrated UEBA and SOAR platforms. It has been demonstrated that the use of NetFlow/IPFIX provides non–invasive, agentless monitoring suitable for large–scale deployment in heterogeneous corporate networks. At the same time, the analysis revealed a technological gap between the high observability of the human factor in network traces (confirmed with high evidential strength in 48% of the studies) and the low capability of purely autonomous NetFlow stream data to accurately identify users (only 36% of the studies with high evidential strength). The study substantiates the critical need to transition to combined solutions based on contextual enrichment of NetFlow data with authentication logs, DNS queries, and system logs within UEBA/SIEM platforms using adaptive machine learning.
References
1. Che cos'è l'analisi del comportamento degli utenti e delle entità (UEBA)? | Microsoft Security. Microsoft – AI, Cloud, Produktivität, Computing, Gaming und Apps. URL: https://www.microsoft.com/it–it/security/business/security–101/what–is–user–entity–behavior–analytics–ueba.
2. Li, B., Springer, J., Bebis, G., & Gunes, M. H. (2013). A survey of network flow applica-tions. Journal of Network and Computer Applications, 36(2), 567–581. https://doi.org/10.1016/j.jnca.2012.12.020.
3. Bakhshandeh A., Eskandari Z. An efficient user identification approach based on Netflow analysis. 2018 15th International ISC (Iranian Society of Cryptology) Conference on Information Security and Cryptology (ISCISC), Tehran, 28–29 August 2018. 2018. URL: https://doi.org/10.1109/iscisc.2018.8546856.
4. Shaman, F., Ghita, B., Clarke, N., & Alruban, A. (2019). User profiling based on applica-tion–level using network metadata. 2019 7th International Symposium on Digital Forensics and Security (ISDFS), 1–8. https://doi.org/10.1109/ISDFS.2019.8757503.
5. Clarke N., Li F., Furnell S. A novel privacy preserving user identification approach for network traffic. Computers & Security. 2017. Vol. 70. P. 335–350. URL: https://doi.org/10.1016/j.cose.2017.06.012 (date of access: 24.08.2026).
6. Imbert, C. (2014). Beyond the cookie: Using network traffic characteristics to enhance confidence in user identity (GIAC Gold Certification paper). SANS Institute. https://www.giac.org/paper/gcia/9063/cookie–network–traffic–characteristics–enhance–confidence–user–identity/119801.
7. Shaman, F. (2020). User profiling based on network application traffic monitoring [Mas-ter’s thesis, University of Plymouth]. https://doi.org/10.24382/652.
8. Rathore, P., & Kolhe, K. (2025). Implementation of a custom SOAR platform: Architec-ture, development and evaluation. International Journal of Environmental Sciences. https://www.researchgate.net/publication/411330715_Implementation_Of_A_Custom_Soar_Platform_Architecture_Development_And_Evaluation.
9. Hassan, A., Rauf, A., Shafqat, N., Latif, R., & Khan, H. (2025). ZenGuard a machine learning based zero trust framework for context aware threat mitigation using SIEM SOAR and UEBA. Scientific Reports, 15, 35871. https://doi.org/10.1038/s41598–025–20998–4.
10. Kitchenham, B., & Charters, S. (2007). Guidelines for performing systematic literature reviews in software engineering (Version 2.3, EBSE Technical Report EBSE–2007–01). Keele University & University of Durham. https://madeyski.e–informatyka.pl/download/Kitchenham07.pdf.
11. Hofstede, R., Čeleda, P., Trammell, B., Drago, I., Sadre, R., Sperotto, A., & Pras, A. (2014). Flow monitoring explained: From packet capture to data analysis with NetFlow and IPFIX. IEEE Communications Surveys & Tutorials, 16(4), 2037–2064. https://doi.org/10.1109/COMST.2014.2321898.
12. Fosić, I., Žagar, D., Grgić, K., & Križanović, V. (2023). Anomaly detection in NetFlow network traffic using supervised machine learning algorithms. Journal of Industrial Informa-tion Integration, 33, Article 100466. https://doi.org/10.1016/j.jii.2023.100466.
13. Alotibi, G., Clarke, N., Li, F., & Furnell, S. (2016). User profiling from network traffic via novel application–level interactions. In 2016 11th International Conference for Internet Technology and Secured Transactions (ICITST) (pp. 279–285). IEEE. https://doi.org/10.1109/ICITST.2016.7856712.
14. Alotibi, G., Clarke, N., Li, F., & Furnell, S. (2016). Identifying users by network traffic metadata. International Journal of Chaotic Computing, 4(2), 103–112. https://doi.org/10.20533/ijcc.2046.3359.2016.0013.
15. Sarmadi, S., Li, M., & Chellappan, S. (2017). On the feasibility of profiling Internet users based on volume and time of usage. In 2017 IEEE Latin–American Conference on Communi-cations (LATINCOM) (pp. 1–6). IEEE. https://cse.usf.edu/~sriramc/17_Latincom_SLC.pdf
16. Zhao, Y., Chen, J., Wu, D., Teng, J., Sharma, N., Sajjanhar, A., & Blumenstein, M. (2019). Network anomaly detection by using a time–decay closed frequent pattern. Informa-tion, 10(8), 262. https://doi.org/10.3390/info10080262.
17. Martín, A. G., Fernández–Isabel, A., Martín de Diego, I., & Beltrán, M. (2021). A survey for user behavior analysis based on machine learning techniques: Current models and applica-tions. Applied Intelligence, 51(8), 6029–6055. https://doi.org/10.1007/s10489–020–02160–x.
18. Prarthana, T. S., & Gangadhar, N. D. (2017). User behaviour anomaly detection in multi-dimensional data. In 2017 IEEE International Conference on Cloud Computing in Emerging Markets (CCEM) (pp. 3–10). IEEE. https://doi.org/10.1109/CCEM.2017.19.
19. Kholidy, H. A. (2021). Detecting impersonation attacks in cloud computing environments using a centric user profiling approach. Future Generation Computer Systems, 117, 299–320. https://doi.org/10.1016/j.future.2020.12.009.
20. Zhang, X., Marwah, M., Lee, I.–T., Arlitt, M., & Goldwasser, D. (2019). ACE: An anomaly contribution explainer for cyber–security applications. In 2019 IEEE International Conference on Big Data (Big Data) (pp. 1991–2000). IEEE. https://doi.org/10.1109/BigData47090.2019.9005989.
21. Shashanka, M., Shen, M.–Y., & Wang, J. (2016). User and entity behavior analytics for enterprise security. In 2016 IEEE International Conference on Big Data (Big Data) (pp. 1867–1874). IEEE. https://doi.org/10.1109/BigData.2016.7840805.
22. Cui, H., Liu, Y., & Wang, X. (2022). Multi–homed abnormal behavior detection algo-rithm based on fuzzy particle swarm cluster in UEBA. https://www.nature.com/articles/s41598–022–26142–w?utm_source=researchgate.net&utm_medium=article/. Scientific Reports, 12, 22349. DOI 10.1038/s41598–022–26142–w.
23. Vinupaul, A., & Bhattacharjee, S. (2016). User characterization through network flow analysis. In 2016 IEEE International Conference on Advanced Networks and Telecommunica-tions Systems (ANTS) (pp. 1–6). IEEE. https://ieeexplore.ieee.org/document/7823965.
24. Krishnamurthy, P., Khorrami, F., Schmidt, S., & Wright, K. (2021). Machine learning for NetFlow anomaly detection with human–readable annotations. IEEE Transactions on Net-work and Service Management, 18(2), 1885–1898. https://ieeexplore.ieee.org/document/9416281.
25. Liu, S. (2022). User and Entity Behavior Analytics Method Based on Adaptive Mixed–Attribute–Data Density Peaks Clustering. International Journal of Data Science and Analysis 2022; 8(5): 163–168 http://www.sciencepublishinggroup.com/j/ijdsa doi: 10.11648/j.ijdsa.20220805.17 ISSN: 2575–1883 (Print); ISSN: 2575–1891 (Online)
26. Melnikov, D., & Schönwälder, M. (2010). Cybermetrics: User identification through network flow analysis. In Proceedings of the 11th International Conference on Passive and Active Network Measurement (PAM 2010) (pp. 234–243). Springer. https://doi.org/10.1007/978–3–642–13986–4_24.
27. Perelman, V., Melnikov, D., & Schönwälder, J. (2011). Flow signatures of popular appli-cations. In 2011 IEEE Network Operations and Management Symposium (NOMS) (pp. 1068–1071). IEEE. https://doi.org/10.1109/INM.2011.5990668.
28. Piskozub, M. (2020). Network traffic behaviour profiling [Doctoral dissertation, Univer-sity of Oxford]. ORA. https://ora.ox.ac.uk/objects/uuid:f40bf0ff–9adb–4d4f–9f87–2bd69eaf6be4.
29. Aquino, J., & Villanueva, R. (2023). Network anomaly detection using NetFlow and network automation. International Journal of Computer Networks and Communications, 15(3), 1–14. https://doi.org/10.1109/ISDFS58141.2023.10131880.
Downloads
Published
Issue
Section
License
Copyright (c) 2026 System technologies
This work is licensed under a Creative Commons Attribution 4.0 International License.
