Table 1.

Factors for abnormal user behavior

Data source	User behavioural sign
Used applications	Changing of the activity time in different applications
Visited sites	Changing of the visited sites list; Visiting sites of another user group
Camera, images	Finding prohibited fragments in the image (photos of documents with signatures, stamps)
Calls, dictophone records	Finding prohibited key phrases, or phrases belonging to another user group
Typed and received text	Phrases which are prohibited to input
GPS coordinates	Change of location