User behavior analysis targets the method of login attempts by users. It's broken up into 3 categories. The first category is login attempts from the physical keyboard and screen of the device. The second category is remote login attempts. This could include terminal services, Remote desktop, or remote assistance. The third category is through the network to access a system resource such as a shared folder. This can be used to determine the method an attacker used is access the network in that instance.