Leveraging AI for UEBA
There were multiple heuristic techniques used to capture the patterns of user and entity behavior. However, the success of Artificial Intelligence (AI) in other problems of pattern recognition has motivated its use in computer security, particularly in UEBA. The idea is to use the data gathered in the SIEM tool, vectorize it, and define features that we will use to train a machine learning model. This model can be trained in an unsupervised manner, or we can also encode the domain knowledge of experts into labels to be able to use supervised machine learning methods.
In the following section, we will describe the common features and feature extraction techniques for UEBA.
UEBA features
The behavior of a user or entity can be characterized by extracting the following feature categories:
- Access patterns: Usually, normal user accounts in a network are used to log in to a subset of physical or virtual devices. Furthermore, the use of privileges should...
