Great post, We have come up with a novel algorithm for behavior change detection using and ML/AI and published in Arxiv.

https://arxiv.org/abs/1902.06663

We have deployed the same algorithm/solution in our non-prod environment and reduced signficant false positive alert.