Scoring Algorithm Identifying Anomalous Behavior in Enterprise Network

Abstract

Enterprise cyber-attacks play a critical role because detecting intrusions in an organization is a usual activity in today’s scenario. We need a security system using which we utilize a variety of algorithms and techniques to detect security-related anomalies and threats in an enterprise network environment. The system helps in providing scores for anomalous activities and produces alerts. The system receives data from multiple intrusion detection or prevention systems which are preprocessed and generates a graphical representation of entities. The proposed scoring algorithm provides a mechanism which aids in detecting anomalous behavior and security threats in an enterprise network environment. The algorithm employs User/Entity behavioral analytics (UEBA) to analyze network traffic logs and user activity data to learn from user behavior to indicate a malicious presence in your environment, whether the threat is previously known or not. Graph-based anomalous detection technique has been applied in this approach, the graph represents each entity’s behavior.