Reducing False Positives of User-to-Entity First-Access Alerts for User Behavior Analytics

Detecting security threats from compromised account or malicious insider by leveraging enterprise traffic logs is the goal of user behavior-based analytics. For its ease of interpretation, a common analytic indicator used in the industry for user behavior analytics is whether a user accesses a network entity, such as a machine or process, for the first time. While this popular indicator does correlate well with the threat activities, it has the potential of generating volumes of false positives. This creates a problem for an analytic system of which the first-time access alerting capability is a part. We believe that the false positive rate from the indicator can be reduced by learning from users' historical entity access patterns and user context information. If the first-time access is expected, then its corresponding alert is suppressed. In this paper, we propose a user-to-entity prediction score which uses a recommender system for learning user data. In particular, we use factorization machines, along with necessary data normalization steps, to make predictions on real-world enterprise logs. We demonstrate this novel method is capable of reducing false positives of users' first-time entity access alerts in user behavior analytics applications.