Anomaly Detection and Enterprise Security using User and Entity Behavior Analytics (UEBA)

Abstract

Digital frauds are made possible by a lack of transparency and other security flaws in a system. Consequently, it has grown to be the most pervasive problem in the world. When these frauds emerge from within businesses, they are referred to as insider threats and may lead to severe consequences. There have been various frameworks proposed to lessen this problem, however, transparency still remains a challenge. Conventionally, storing data in chronological order to prevent data manipulation is one technique to ensure traceability and security. In this paper, we present a framework based on User Entity and Behavioral Analysis (UEBA) approach to study user profiles over time and classify them as normal or aberrant. The proposed framework utilises additional information including IP addresses, location data, and the users’ organizations etc. We focus on applying data science and analytical methods to create data visualizations for analysis and anomaly identification.