A cybersecurity process that uses algorithms and machine learning to detect anomalies in the patterns of users and entities (such as routers, servers, and endpoints) within a network. Unlike traditional security tools that look for known file-based threats or static if/then rules, UEBA builds a baseline of “normal” behavior and flags deviations that could indicate a security breach.
Core Components
- Profiling (Baselining): The system monitors activity over a period (usually 30 days) to establish a standard behavior for every user and device. This includes login times, typical file access, and data upload volumes.
- Entity Analytics: Beyond human users, UEBA tracks entities—non-human assets like IoT devices, automated service accounts, and cloud instances—which are frequent targets for lateral movement in a cyberattack.
- Risk Scoring: When an activity deviates from the baseline, the UEBA engine assigns a numerical risk score. As suspicious activities accumulate (e.g., a user logs in at 3:00 AM and accesses a restricted database and exports a large file), the score increases until it triggers an alert.
How It Works: The Detection Logic
- Data Ingestion: UEBA aggregates data from various sources, including system logs, SIEM (Security Information and Event Management) platforms, and DLP (Data Loss Prevention) tools.
- Comparison: The system compares real-time activity against the established historical baseline and peer group behavior (e.g., “Is this marketer doing something unusual compared to other marketers?”).
- Anomaly Detection: It identifies specific types of deviations:
- Temporal Anomalies: Logging in at unusual hours.
- Geographic Anomalies: Accessing the network from an unexpected location or a “fast-travel” impossibility (logging in from New York and London within an hour).
- Data Anomalies: Downloading significantly more data than usual.
- Alerting: Once the risk score passes a critical threshold, the system alerts security analysts or triggers an automated response.
UEBA vs. Traditional UBA
While User Behavior Analytics (UBA) was the predecessor, UEBA expanded the scope significantly:
| Feature | User Behavior Analytics (UBA) | User & Entity Behavior Analytics (UEBA) |
| Primary Focus | Human users only. | Humans + Devices, Servers, & IoT. |
| Detection Scope | Simple insider threats. | Insider threats, compromised accounts, & lateral movement. |
| Intelligence | Basic statistical analysis. | Advanced Machine Learning & Deep Learning. |
| Data Sources | Primarily log files. | Logs, packet data, cloud activity, & endpoint telemetry. |
Key Benefits
- Detecting “Low and Slow” Attacks: Hackers often move slowly through a network to avoid triggering traditional alarms. UEBA identifies these subtle shifts in behavior over time.
- Reducing Alert Fatigue: By focusing on high-risk scores rather than thousands of individual “minor” events, security teams can focus on the most likely threats.
- Identifying Compromised Credentials: If a valid user’s password is stolen, a firewall won’t stop the “authorized” login. UEBA, however, will notice that the “user” is suddenly accessing folders they have never touched before.
