A Neuro-fuzzy approach for user behaviour classification and prediction

Abstract

Big data and cloud computing technology appeared on the scene as new trends due to the rapid growth of social media usage over the last decade. Big data represent the immense volume of complex data that show more details about behaviours, activities, and events that occur around the world. As a result, big data analytics needs to access diverse types of resources within a decreased response time to produce accurate and stable business experimentation that could help make brilliant decisions for organizations in real-time. These developments have spurred a revolutionary transformation in research, inventions, and business marketing. User behaviour analysis for classification and prediction is one of the hottest topics in data science. This type of analysis is performed for several purposes, such as finding users’ interests about a product (for marketing, e-commerce, etc.) or toward an event (elections, championships, etc.) and observing suspicious activities (security and privacy) based on their traits over the Internet. In this paper, a neuro-fuzzy approach for the classification and prediction of user behaviour is proposed. A dataset, composed of users’ temporal logs containing three types of information, namely, local machine, network and web usage logs, is targeted. To complement the analysis, each user’s 360-degree feedback is also utilized. Various rules have been implemented to address the company’s policy for determining the precise behaviour of a user, which could be helpful in managerial decisions. For prediction, a Gaussian Radial Basis Function Neural Network (GRBF-NN) is trained based on the example set generated by a Fuzzy Rule Based System (FRBS) and the 360-degree feedback of the user. The results are obtained and compared with other state-of-the-art schemes in the literature, and the scheme is found to be promising in terms of classification as well as prediction accuracy.

Introduction

Online user behaviour analysis is an important area of research that enables different characteristics of users to be studied. The behaviour study and prediction of user intention towards certain products help business houses and industries find the target areas to focus on. The prediction of user intention is based on the interactions within a website [1], which is crucial for retargeting. Usually, e-commerce sites and ad display networks keep track of the search patterns of users to understand their intentions and behaviours. In addition, understanding the demand and making relevant information available for online users on the pretext of the explosive growth of information on the Internet enforces analysis and modelling of the web navigation behaviour of web users. Web mining techniques have become handy to analyse and extract useful information [2] from web content, and they are categorized into web content mining, web usage mining and web structure mining. In a nutshell, web documents are extracted by web content mining, user browsing activities are analysed by web usage mining, and the physical link structure of websites is analysed by web structure mining. Weblogs, which contain user website navigation information such as IP address, client/user id, date, time, method, status code and size of the object, are used by web usage data mining to predict user behaviour. The log is an array of user transactions that is updated [3] every time the user accesses websites. The web log data are then processed by a sequence of operations [4], such as Data Cleaning, User Identification, Session Identification, Enhanced Pattern Tree Construction, and Pattern Recognition, to retrieve the usage pattern of each user of the website based on his/her activities during the browsing, such as clicks, visited regions, revisits, etc. Many soft computing and data mining algorithms have been suggested by researchers to identify useful patterns in the user’s web profile.

Dynamic consolidation frameworks typically consist of many overlapped domains [5], which have been divided into five main subsystems, of which the workload prediction subsystem uses a clustering process, VM and user behaviour estimation, prediction window size, and forecasting process. Authors in [6] enhanced the preciseness of the prediction accuracy of the regression models regarding the changing workload patterns by isolating and studying the impact of the risk minimization principle. The increasing popularity and developments of the e-commerce portals lead to the need to address requirements for privacy and security [7] and help to evaluate shopping behaviour in various domains within the context of mobile devices and the cloud [8].

This paper proposes an automated monitoring and prediction tool, particularly for organizations where there are restrictions on web usage or network access, i.e. each user is given certain privileges and is restricted from certain accesses. This is a common scenario in almost every organization around the globe; hence, there is a dire need to observe users’ activities to prevent any unwanted event, such as data theft, virus injection, sniffing and spoofing, etc. The neuro-fuzzy-based prediction system monitors the history of network/web usage of users and then predicts the behaviour as one of the predefined categories. Although the network is equipped with a monitoring system that prevents users from performing the restricted tasks, this system focuses on studying the intentions of users who attempt to conduct the restricted tasks from time to time and reveals the proneness of a user to committing intentional mistakes. The fuzzy rule-based system (FRBS) receives three input variables, namely, normalized web frequency, normalized network frequency and normalized machine frequency, and predicts one output variable named “Suspectedness” that represents the user’s tendency to attempt something suspicious. To make the scheme effective and robust, a Gaussian Radial Basis Function Neural Network is extensively trained based on the examples duly generated by FRBS. Once the network is sufficiently trained, it can readily classify a user based on the provided input parameter composed of user characteristics.

The remainder of the paper is organized as follows. Section 2 is dedicated to a literature review, and section 3 describes the proposed scheme. In section 4, the proposed scheme is simulated and results are analysed, while section 5 concludes the paper.

Literature review

Predicting the behaviour of web users is an evolving area of web data mining concerning optimisation of web applications based on the study of web user behaviour. Correctly identifying the behaviour of online users is a challenging task because it requires accurate identification of malicious users from the legitimate users. An analysis of the characteristics of online user behaviour models is studied in [9], and the results show that feature extraction techniques, such as principle component analysis (PCA), independent component analysis (ICA) and self-organizing maps (SOM), can be used to correctly detect anomalies in user behaviour. REPTree and neural network are studied with different parameters and found to be the best models in comparison to others. Various behavioural evaluation techniques have been investigated [10], and their appropriateness for E-learner behaviour evaluation has been analysed. The results of the study established that Kernelized Fuzzy C-mean (KFCM) Clustering is a better technique than simple Fuzzy C-Means (FCM) for behaviour evaluation.

Phishing website detection and identification is a complex problem involving many criteria. A multi-layer neural network framework suggested by [11] accurately classifies and predicts phishing websites. In the past few decades, smartphones and tablets have been used to store a plethora of information related to our day-to-day life, which has prompted mobile attackers to develop malicious applications targeting Android machines. F. Martinelli et al. [12] designed a deep learning classifier on a recent dataset to address this issue and experimentally showed the effectiveness of the model by achieving encouraging results. Another investigation is made by [13] based on user behaviour within a large e-commerce site for predicting the buying intention of customers. They proposed a model consisting of Deep Belief Networks and Stacked Denoising auto-Encoders and showed that the extraction of features from high-dimensional data achieves a substantial improvement. The approach used to analyse user behaviour has great potential in optimising web online advertising [14] and ad-serving systems [15].

Machine learning, data mining, statistics, pattern recognition, and graph theory techniques are used to extract useful information from social network sites. However, graph theory [16] is used to detect anomalies in the user behaviour. Similarly, researchers studying the anomalies in user data and abnormalities in user behaviour use PCA [17]. The study of human behaviour characteristics on social media based on their post and reply behaviours at different times of a day [18] on online forums has revealed some interesting features that are helpful for detecting spam and spammers. The understanding of user behaviour in online-social-network (OSN) is a great challenge for social network analysis. The study and analysis of the behaviour of the users who are members of two social networks found important specificities [19] about their privacy settings, their selection of friends and the activities they perform, and more specifically, the analysis is consistent with the recent findings. In addition, many algorithms, such as Fuzzy Rule Based System (FRBS) [20], Association Rule Mining, Linear Regression [21], REPTree [22], etc., are employed to classify user behaviour depending on their past web usage activities, and in turn, it helps in maintaining network security and privacy. In [23], the authors summarize automated opinion mining from web usage logs and social networks, including Twitter, Facebook, etc. It is further narrated that various techniques have been utilized in this regard, including machine learning, deep learning, text and data mining, etc. It is concluded that machine-learning approaches are better in terms of classification accuracy and robustness [24,25,26].

Behaviour analysis and prediction could be used in many fields of real life, for example, in the educational domain: predicting students’ progress, trends in a particular subject, evaluation of a course/teacher [27,28,29,30], and dropout rate in an institute [31]. Researchers also study classification and prediction of customer shopping trends concerning a particular product [32], which is of prime importance in e-business and e-commerce. In [33], the authors investigated a recurrent neural network for human behaviour prediction. The purpose was to provide good governance to people having risks related to slight mental impairment and weakness. A long-short term memory network model was developed by calculating actions, activities and inter-activity and intra-activity behaviours. Consequently, the model could predict the next possible behaviour of the person. The techniques [34, 35] provide human behaviour analysis for the sake of predicting the next possible action based on his/her previous traits and activities performed and observed by various techniques, such as feedback, monitoring sensors, etc., in a particular environment. In [34], the researchers combined data-driven and knowledge-driven techniques for activity modelling. A clustering algorithm was developed to extract knowledge from a domain expert’s knowledgebase. Consequently, the technique has been tested with real user input, noisy sensors and challenging activity arrangements, and 100% accuracy was obtained, but at the cost of learning some false-positive models. In [35], a similar approach for activity identification was proposed. In [36], researchers provide a technique for identifying daily life activities to assist elderly and mentally challenged persons. The proposed technique outperforms the existing knowledge-driven and ontology-based approaches by employing Latent Dirichlet Allocation (LDA) topic modelling [36] and testing over Kasteren [37] and Ordonez datasets [38]. In short, user behaviour classification, modelling, profiling and prediction for the sake of different benefits in different fields of life, such as trend analysis, security and privacy, e-commerce, education, banking, medicine, etc., is the hottest area of research in data mining and machine learning [39]. Because it is a complex phenomenon, the effectiveness of schemes may vary over the domains. Thus, to help address this issue, hybrid intelligent techniques composed of evolutionary and soft computing techniques [40, 44] have been investigated in this research.

Although numerous approaches have been designed for user classification in the literature, their application areas are too generic, and the domain is wide. Moreover, their main interest was to find a user’s trait relative to an entity, a product or an activity. In this research, a neuro-fuzzy-based customized user monitoring system to continuously monitor users’ activities within an organization by augmenting his/her 360-degree feedback is proposed, where the rules regarding user behaviour are set by the organization.

Proposed scheme

The system model considered for the research is an organization where there are several departments connected through a local area network (LAN). The employees/users are allowed/disallowed to perform certain activities on their machines, the LAN and the web. For example, as far as machine restrictions are concerned, users are not allowed to insert any flash drive because of the organization’s policy. Even the USB ports are disabled by the administrator; however, any attempt in this regard is recorded and logged. Similarly, as far as the network is concerned, users are only allowed to visit their privileged areas that vary from user to user based on his/her role. An admin has one role, a manager has a different role, etc. Any attempt to reach a restricted area is prohibited yet recorded in the form of logs. There are many servers on the network, such as database servers, web servers, application servers, proxy servers, etc., where the logs are maintained. Likewise, the web usage is also restricted, and users are not allowed to browse certain websites. For example, only the organizational email server is allowed, where all of the emails are scanned. Other email servers, such as Gmail, Yahoo, etc., are not allowed. Similarly, there are rules for access to certain websites, and so on. This is a common scenario in almost every organization around the globe; hence, there is a dire need to observe users’ activities to prevent any unwanted event, such as data theft, virus injection, sniffing and spoofing, etc.

Data sources

The machine, network and web utilization information primarily preserve records of accessibility styles of the user/visitors. This information can also include the user’s visibilities, bookmarks, cookies, modification information, customer concerns and any other communications of the consumer while on the web page. For easy manageability and convenience, the information is arranged into three sections: System Variety Logs, Entrance Variety Logs and Client Web browser Logs. The web server preserves crucial details for network utilized excavation, these records are in general accessibility of websites by multiple users. Each of the records contain the IP address of the user, request time, Consistent Resource Locator, HTTP status cipher, etc. Of course, the details collected are in several standard types, such as log information structure, expanded log information structure, etc., is a portion of a network organized log in W3C. Information for the machine, network and web exploration can be gathered from three sources described below. Two of them are of almost the same type, “Web server logs” and “Proxy server logs,” while the third one has different characteristics and framework than the other two sources. Details regarding all three are given in Table 1 and Table 2. These logs are duly collected for one calendar year, from an organizational centralized network server, for the sake of this study.

Table 1 Web data sources

Table 2 Machine and Network Data sources

The information gathered in this process comes from three different locations:

• Server-side collection - the browser behaviour of the web user is gathered in the log file of the site server.

• Client-side collection - uses a user-side application, such as a remote agent, to gather the information of the customer navigation.

• Web proxy server-Web proxy’s server takes HTTP demand from the user, the user sends demand to the web server via proxy servers. Proxy-server development is a trial. Advanced network development, such as TCP/IP, is required for this development. The demand interception is limited.

LOG data processing

The overall information planning process is briefly described in the following segments described in Fig. 1. First, a log monitoring server is dedicated to collecting all types of user usage logs, e.g. machine, network and web usage. The logs are in the form of events driven from the Windows Server, which comprises all the types given in Tables 1 and 2 for web, machine and network logs. Due to heterogeneity, these logs need careful parsing and are hence fetched by the Log Parsing Engine, which consists of the following steps.

Fig. 1

Schematic of the proposed system model

Log parsing engine

Not all of the entries of the user’s log are useful for the sake of analysis. Thus, irrelevant information must be discarded prior to further data analysis. For example, accesses to unrelated products (such as key images), accesses by Web spiders (i.e. non-human accesses), and unsuccessful demands should be eliminated.

Weighted frequency calculation

The log files are in the form of text files. This block removes the noise words and unnecessary information and calculates the frequencies of each violation type obtained from the respective log, namely, web frequency, network frequency and machine frequency. Frequency is an important factor, based on which the gravity of the violation may vary. Similarly, the second factor associated is the weight of the violation. Mathematically,

$$ {F}_{Web}={\sum}_{m=0}^{M-1}{\omega}_m{f}_m $$

(1)

Here, M is the total number of website categories being monitored, e.g. email, online shopping, safe/unsafe websites, social network sites, entertainment, etc., where ω_m is the associated weight factor for each website category having a value between 0 and 1 (0 represents the least harmful or safe/allowed websites, and 1 represents the most harmful or disallowed websites) and f_m represents the frequency of visit/usage of that type. The categorization and the weight assignment of each category are imposed by the organization and may vary from one organization to another. Similarly, the network log frequencies may be expressed as:

$$ {F}_{Net}={\sum}_{n=0}^{N-1}{\omega}_n{f}_n $$

(2)

Here, N is the total number of network activities being monitored, e.g. FTP, shared folders, user area, etc., where ω_n and f_n are the weight assigned to each network category and the frequency of access to that category, respectively. Similarly, the machine log frequencies may be expressed as:

$$ {F}_{Mac}={\sum}_{p=0}^{P-1}{\omega}_p{f}_p $$

(3)

Here, P is the total number of machine activities being monitored, e.g. flash or pen drive attachment, disk I/O, killing processes, etc., where ω_p and f_p are the weight assigned to each machine log category and the frequency of access to that category, respectively.

Normalizing frequencies

The frequencies of each type may be a large number that may increase the respective value of the weighted frequency score, so there is a need for normalization. Normalization is performed by dividing the corresponding weighted frequency factor by the number of total categories and the maximum frequency in the respective type. Subsequently, normalization activity will be performed to normalize the frequency of each type. Normalization is subject to the total categories in that type and the maximum frequency in that type. Thus, Eqs. 4–6 represent NF_Web, NF_Net and NF_Mac, namely, normalized web, network and machine frequencies, respectively. These are given by:

$$ {NF}_{Web}=\frac{F_{Web}}{M\ast \mathit{\max}\left({f}_1,{f}_2,\dots, {f}_M\right)} $$

(4)

$$ {NF}_{Net}=\frac{F_{Net}}{N\ast \mathit{\max}\left({f}_1,{f}_2,\dots, {f}_N\right)} $$

(5)

$$ {NF}_{Mac}=\frac{F_{Mac}}{P\ast \mathit{\max}\left({f}_1,{f}_2,\dots, {f}_P\right)} $$

(6)

where M, N and P are the total categories in each type. After normalization, the frequency factor is confined between 0 and 1 so that the inputs become compatible with the input format of the proposed neuro-fuzzy rule-based system.

Design of the Fuzzy Rule-Based System

The design of the fuzzy rule-based system is originally motivated by [21]. There are three input variables to the fuzzy rule-based system (FRBS), namely, normalized web frequency, normalized network frequency and normalized machine frequency. There is one output variable named “Suspectedness” that represents the user’s tendency to attempt something suspicious. These variables are shown in Figs. 2, 3, 4 and 5, respectively.

Fig. 2

First input variable “Normalized Web Frequency”

Fig. 3

Second input variable “Normalized Network Frequency”

Fig. 4

Third input variable “Normalized Machine Frequency”

The overall rule surfaces are shown in Fig 6. The total number of rules in the rule-based system is the Cartesian product of the number of membership functions in each input variable, so there are one hundred and twenty-five rules in the designed rule base. These rules are formulated based on maximum likelihood (ML) criteria with normal distribution. The design of the fuzzy rule-based system is carried out in the MATLAB Fuzzy Logic Toolbox, and the parameters are given in Table 3. The rule format is given below.

IF ((NF-web= “vLow”) AND (NF-net= “Medium”) AND (NF-mac = “vHigh”)) THEN (Suspectedness= “Medium”)

Table 3 FRBS parameters

Fig. 5

Output variable “Suspectedness”

Fig. 6

Rule surfaces.

Fig. 7

Block diagram of the GRBF-NN

Fig. 8

Network training using the LMS algorithm

Fig. 9

Convergence Rate

Fig. 10

Single User Behaviour

Fig. 11

Joint Behaviour

Fig. 12

360-degree Feedback analysis

Fig. 13

a GRBF-NN prediction vs. Linear Prediction [21]. Fig. 13b: GRBF-NN prediction vs. Linear Prediction [21]

User’s 360 feedback

The user’s 360 feedback is an important measure of an employee’s overall behaviour evaluated by the concerned authorities. The common attributes of 360 feedback are usually associated with the employee’s performance, contribution, and productivity and are directly linked with his/her appraisal. There are different theories about this feedback, and its pros and cons may vary from organization to organization [41]. In this research, it is considered as a complementing factor to the technological usage behavioural model discussed previously for accurate user profiling.

Gaussian radial basis function neural network (GRBF-NN)

Gaussian Radial Basis Function Neural Networks (GRBF-NNs) are considered the most powerful networks for dynamic and nonlinear systems [42]. The fast, linear learning algorithm is capable of representing complex non-linear mapping and also improves the generalization capability of the network. In this research, GRBF-NNs are suitable due to the dynamic nature of the problem where we need to precisely predict the user’s behaviour based on his machine, network and web usage history, as well as his 360-degree feedback. The schematic diagram for the NN is given in Fig. 7.

The following are the steps involved in construction of the network.

Example set

To train the network, a large number of examples are generated by the proposed Fuzzy Rule-Based System and augmented with the user’s 360 feedback, where both are in the form of a number. This training is performed in the following manner.

• Choosing a user’s behaviour (Suspectedness) from FRBS (× 1)

• Selecting the 360-degree feedback of the same user (× 2)

• Finding the aggregate of both by the following formula:

$$ Final\kern0.17em behaviour(d)=\alpha \left(360- degree\kern0.17em feedback\right)+\left(1-\alpha \right)\left( FRBS\kern0.17em feedback\right) $$

(7)

Here, α ranges between 0 and 1 and corresponds to the factor chosen by an organization that what weight should be assigned to each type of feedback. For example, if the 360-feedback is given a value of 0.7 (70%), the FRBS feedback will be assigned 0.3 (30%), and so on. The FRBS feedback becomes an example of what should be the final behaviour, provided the FRBS feedback and 360-degree feedback. $\left[{\boldsymbol{x}}_i^1,{\boldsymbol{x}}_i^2;{\boldsymbol{d}}_i\right].$

Here, d represents the final behaviour of the user, where lower values represent good behaviour and higher values correspond to bad behaviour.

• A number of examples are generated to make an example set of N in total, i.e. ${\left[{\boldsymbol{x}}_i^1,{\boldsymbol{x}}_i^2;{\boldsymbol{d}}_i\right]}_{i=1}^N$

Training

The network is trained by the supervised Least Mean Square (LMS) algorithm [43]. The training process is shown in Fig. 8. In this process, an example [× 1,× 2] is introduced to the network, the output (y) is compared with the desired output (d), and consequently, the absolute error (e = abs(y-d)) is fed back to the LMS algorithm that updates the weights (w). Then, the change in weights is incorporated in the network.

Simulation results

This section contains the experimental results pertaining to the proposed scheme. In this regard, the dataset is obtained from [21] and contains thousands of pieces of users’ data over more than twenty-fine months. The dataset is composed of a mixed log related to machine, network and web usage.

Figure 9 shows the convergence rate of the proposed network during testing and training phases with respect to iterations. This finding shows that, over the iterations, the error rate touches its minimum. The convergence rate goes abruptly after 300 onward iterations and eventually tapers off to zero after 3000 iterations. There is no significant difference between the convergences of the testing and training phases mainly because of the fair adoption of examples for each phase.

The sigmoidal function was used as the signature function due to its soft nature of mapping instead of the signum function, which is suitable for hard decision mappings. The normalized machine, network and web frequencies of ten users and the corresponding output of FRBS are enlisted in Table 4 for one calendar year.

Table 4 users’ normalized frequencies

Figure 10 shows the behaviour of a single user based on his/her machine, network and web usage. The three inputs are fetched to the FRBS, and the resultant outcome is plotted over the entire year. It can be observed that the user’s activities were suspicious in the months of February, June, August and October. During the months of January, March and July, the behaviour was safe, and during April, May, November, and December, it was moderate. The same trend can be observed in the stacked bar graph given in Fig. 11, where the high bars show the most and low bars show the least suspected level, and FRBS output is represented by the colour yellow.

Figure 12 shows the role of 360-degree feedback in conjunction with the proposed FRBS. The combined process is given in Eq. 7, which shows that the weight given to each feedback, that is, 360-degree feedback and FRBS-based feedback, is connected via a variable alpha (α), which is a relative distribution between the two types of feedbacks. If we choose alpha as 70%, then this is the weight of the 360-degree feedback, while the FRBS feedback will have 30%, and so on.

To show the effectiveness of this factor and 360-degree feedback inclusion, three cases are considered in Fig. 12, i.e. the 360-degree feedback values as 70%, 50% and 30%, respectively. The joint behaviour of random users is considered, where the annual average of the FRBS feedback was 0.479797517. The overall behaviour was plotted with respect to alpha ranging between 0 and 1.

At (α = 0), the value is exactly as FRBS; however, with an increase in the value of α, the 360-degree feedback comes into consideration. In this case, the blue bars show the case of 360-degree feedback as 70% (which means users received worse feedback; here, the assumption is that, the higher the number, the worse the feedback, and vice versa); now as α is increasing, the overall behaviour is going to be worse (getting higher). Similarly, when the 360-degree feedback value is 50%, an equal weight is expected for all of the values of behaviour because the FRBS feedback is close to it. At a 360-degree value of 30%, the overall value of the bar is decreasing, which shows that for higher values of α, where the 360-degree feedback received more weight, the overall user’s credibility is improved.

In short, the value of α is purely an organizational choice where the administration decides which feedback should be given which weight.

Figure 13a shows the performance of the GRBF Neural Network as a predictor in the case of an individual user. Here, the solid line shows the actual behavioural value; the curved line shows the prediction trend of the Neural Network, while the straight line shows the linear prediction used in [21]. It is apparent from the diagram that the proposed GRBF-NN closely follows the user trend over the monthly data. Because the data are sparse (monthly basis), the network trendline is not very close to the actual value; however, for the dense data, it can follow more closely. To further differentiate the performance of the proposed GRBF-NN-based prediction over the linear prediction given in [21], Fig. 13b shows the trend line over the bar chart.

As far as complexity and overhead of the proposed approach is concerned, the technique is composed of three main phases, namely, the dataset generation (using FRBS and 360-degree feedback), training phase and testing phase, respectively. The main complexity is involved in the dataset generation and training phases, which are purely offline processes. Once the network is sufficiently trained, the complexity becomes constant because, as the input appears to the network, it is classified into the corresponding behaviour class regardless of the nature of the example. However, the scheme given in [21] exhibits a relatively higher complexity because, in that case, every time a new example appears at the input, the technique executes the complete classification algorithm to find the final behaviour of the user.

Conclusion

This paper presents a novel technique for user behaviour classification and prediction using a Fuzzy Rule-Based System (FRBS) augmented with 360-degree user organizational feedback (the 360-degree feedback plays a vital role in organizations to precisely classify/ratify an employee) and Gaussian Radial Basis Function Neural Network (GRBF-NN), respectively. The FRBS was designed to classify the user based on his/her machine, network and web usage logs duly collected by a network server of the organization. The logs are pre-processed in a series of steps, prior to fetching them in FRBS. The designed FRBS and 360-degree feedback are jointly used to produce the example set for the GRBF-NN, which is done by, first, randomly picking examples from the dataset; second, passing through the FRBS, which classifies the user based on his/her logs; and third, by augmenting the same user’s 360-degree feedback. Upon sufficiently training the network, it can precisely predict the behaviour of a user on the fly.

In the future, the proposed scheme can be further fine-tuned for further perfection. For example, in the current scheme, while designing FRBS, all types of logs are given equal weights; in the future, the weights may be different for each type of activity depending upon organizational policies. Moreover, the 360-degree feedback is an annual feedback, while the logs are processed on a monthly basis. The alignment can be performed by introducing other types of feedback, such as weekly and monthly feedback. To further fine-tune the results, hybrid intelligent techniques with deep learning concepts may also be investigated.