UEBA Affinity Scoring for First-Time Access Alert Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing user behavior analytics systems face challenges in distinguishing between legitimate and malicious first-time access events in computer networks, leading to high false positive alerts and inadequate cyber threat detection.
Innovation Solution
A UEBA system employs a factorization machine to calculate a user-to-entity affinity measure based on historical access patterns and context data, using an affinity threshold to filter or weight first-time access alerts, thereby reducing false positives and enhancing cybersecurity risk assessments.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If first-time access alerts are used to detect malicious activities, then cyber threat detection capability is improved, but false positive alert rate increases
Solution Approach 1:
The system changes the parameter of alert evaluation by introducing an affinity score that quantifies the relationship between user and entity. Instead of simply flagging all first-time accesses as suspicious, the system calculates an affinity measure based on historical access patterns and uses this parameter to differentiate between legitimate and malicious first-time accesses, thereby reducing false positives while maintaining detection capability
Solution Approach 2:
The system replaces the mechanical rule-based approach (flagging all first-time accesses) with a machine learning-based factorization machine that learns complex patterns from historical data. This substitution enables the system to automatically distinguish between legitimate and malicious behaviors without requiring manual rule tuning, effectively reducing false positives while maintaining high detection accuracy
2Reliability
If traditional blacklist signature matching is used for security monitoring, then known threats are detected, but coverage against signature-less attacks is insufficient
Solution Approach 1:
The system performs preliminary action by building comprehensive user behavior profiles that capture historical access patterns, preferred entities, and temporal characteristics before attacks occur. These pre-established profiles enable the system to detect anomalies and signature-less attacks by comparing current behavior against the baseline, providing both known threat detection and adaptability to new attack vectors
Solution Approach 2:
The system achieves universality by creating a multi-functional security monitoring approach that simultaneously handles known threats through pattern matching and unknown threats through anomaly detection. The user behavior profiles serve multiple purposes: detecting blacklist violations, identifying lateral movement, spotting insider threats, and recognizing compromised accounts, thereby providing comprehensive coverage across diverse attack types
3Reliability
If user behavior profiles are maintained for anomaly detection, then malicious activities are identified, but legitimate dynamic user activities are misclassified as false positives
Solution Approach 1:
The system applies dynamics by making user behavior profiles adaptive rather than static. The profiles are continuously updated with new access patterns, allowing the system to accommodate legitimate changes in user behavior such as accessing new entities during normal work activities. This dynamic approach ensures that only genuine anomalies are flagged while adapting to evolving legitimate user patterns
Data Source
AI summary
The present disclosure describes a system, method, and computer program for determining the cybersecurity risk associated with a first-time access event in a computer network. In response to receiving an alert that a user has accessed a network entity for the first time, a user behavior analytics system uses a factorization machine to determine the affinity between the accessing user and the accessed entity. The affinity measure is based on the accessing user's historical access patterns in the network, as wells as context data for both the accessing user and the accessed entity. The affinity score for an access event may be used to filter first-time access alerts or weight first-time access alerts in performing a risk assessment of the accessing user's network activity. The result is that many false-positive first-time access alerts are suppressed and not factored (or not factored heavily) into cybersecurity risk assessments.