User and Entity Behavior Analysis (UEBA) is a model that assists to track suspicious or malicious intent of cyber attackers. It uses an advanced machine learning technique that monitors system logs, data flow, report generation and other related information.

For example, if a thief gets hold of your credit card and starts making sudden huge purchases, the system detects this abnormal spending and blocks the suspicious transactions. Then, the credit card company calls you to verify the purchases. UEBA works in a similar way but with a more complex machine learning algorithm.

How UEBA Works

UEBA monitors the behavior of employees, vendors, contractors, and personnel who have access to applications, accounts, and servers of an organization that stores proprietary data. It then processes this information internally to judge if a particular activity or behavior could result in a cyber attack.

UEBA goes a step further than just tracking events and devices. It can also machine learn and monitor possible threats from insiders (employees who have gone rogue). This is done by creating a baseline of where an end user logs in from, which files and servers they usually access, privileges they have, frequency and time of access, devices used for access, and more.

The basic proposition on which UEBA works is very simple. It is easy to hack an employee’s credentials such as username and password with a malicious intent. But, it will not be possible for the hacker to mimic the user’s regular behavior once inside the network.

Let's say a user account normally downloads a certain file size every day from a particular device and accesses a set number of servers every week.  If it is noticed that suddenly the account is downloading gigabytes of files from a foreign location or is accessing new servers, UEBA will raise a flag.

UEBA has established patterns built into the system which also self-learns based on permissions and access granted to every endpoint user. Using algorithms, UEBA can detect patterns and anomalies much faster compared to ordinary human detection as well as insider threats that may otherwise go entirely unnoticed.

Types of Threats Addressed by UEBA

Insider Threats

It is a possibility that an employee or even a group of them could go rogue. There could be several factors behind this intent. It could be done for financial gain by selling Personal Identifiable Information(PII) or for business gain by exploiting intellectual property. There could be other reasons such as seeking revenge due to disagreements, job dissatisfaction or a potential layoff. Another motive for an insider threat could be deep-rooted political, social or religious beliefs.

Hacked Privileged Accounts

Often, executives have access to sensitive company data and are also granted exceptions due to their high company profile. In some other cases, contractors and senior employees are also granted short-term access to sensitive data for a project and these access rights could later not be reset. Hackers are highly skilled and are on the lookout for such accounts to access and exploit secured data and information.

Password Attacks

Cyber attacks are not a one-time event and are not isolated from each other. Once an attacker has acquired a password from a security breach, the hacker can use Brute Force and try variations of the password and passphrases to penetrate into different accounts of the targeted user in future.  Hackers leverage on the knowledge that users are likely to use a particular variation of the password for different sites they access.