Abstract

Traditional signature-based and rule-based security controls are increasingly unable to detect slow, low-and-slow, and insider-driven attacks that mimic legitimate activity. User and Entity Behavior Analytics (UEBA) addresses this gap by continuously learning the normal behavioral patterns of users, hosts, applications and network entities and flagging statistically significant deviations as potential threats. This paper proposes a hybrid UEBA algorithm that combines statistical behavioral baselining, unsupervised anomaly detection using an Isolation Forest model, and a multi-factor risk-scoring engine that aggregates several behavioral indicators into a single actionable risk score. A reference implementation is presented in Python using scikit-learn, operating on a simulated enterprise log dataset comprising login activity, file-access volume, data-transfer size, failed-login attempts, after-hours activity and privilege-escalation events. The proposed model is benchmarked against One-Class SVM and LSTM-Autoencoder baselines using accuracy, precision, recall, F1-score, false-positive rate and average detection latency. Experimental results show that the proposed hybrid UEBA approach improves overall detection accuracy and substantially reduces false positives compared with the single-algorithm baselines, while remaining lightweight enough for near real-time deployment within a Security Operations Centre (SOC).

Authors

V.J. Fready Blesson, A. Nithya Rani
CMS College of Science and Commerce, India

Keywords

User and Entity Behavior Analytics (UEBA), Insider Threat Detection, Anomaly Detection, Isolation Forest, Machine Learning, Security Information and Event Management (SIEM), Risk Scoring, Behavioral Baseline