When the user behavior deviates from the regular operation, it is defined as aggressive behavior. The efficiency of anomaly detection techniques largely depends on the completeness of typical user characteristics and the detection frequency. Unknown attacks can be effectively detected because each episode...