| Peer-Reviewed

User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering

Received: 6 October 2022     Accepted: 25 October 2022     Published: 29 October 2022
Views:       Downloads:
Abstract

In the era of digital economy, new technologies emerge in an endless stream, and the network environment becomes increasingly complex. Traditional security products, technologies and solutions cannot meet the needs. In order to deal with the increasingly severe network security challenges, User and Entity Behavior Analytics (UEBA) technology provides a new solution. The application of new technologies such as statistical analysis, machine learning and deep learning also increases the adaptability and effectiveness of UEBA technology. User and entity behavior analysis technology based on machine learning has also become one of the research hotspots in current academia. In this paper, An User and Entity Behavior Analytics Method based on Adaptive Mixed-Attribute-Data Density Peaks Clustering is proposed. Firstly, the relevant access behavior data records of user entities are extracted from the access logs of the servers that need to be monitored. Since these records contain mixed attributes, adaptive mixed-attribute-data density peak clustering (AMDPC) can be used for clustering. Then, by constructing the user behavior baseline in each cluster, suspicious users and behaviors are analyzed. Combined with log backtracking and expert manual verification, the threat behavior is finally determined. This method has been applied in a company's network security situation awareness platform, and has achieved good practical results.

Published in International Journal of Data Science and Analysis (Volume 8, Issue 5)
DOI 10.11648/j.ijdsa.20220805.17
Page(s) 163-168
Creative Commons

This is an Open Access article, distributed under the terms of the Creative Commons Attribution 4.0 International License (http://creativecommons.org/licenses/by/4.0/), which permits unrestricted use, distribution and reproduction in any medium or format, provided the original work is properly cited.

Copyright

Copyright © The Author(s), 2022. Published by Science Publishing Group

Keywords

User and Entity Behavior Analytics, UEBA, Density Peaks Clustering, AMDPC, Cybersecurity

References
[1] Security Research Institute of China Academy of Information and Communications Technology, Hangzhou Anheng Information Technology Co., LTD., "User Entity Behavior Analytics Technology (UEBA) (2020).", 2020.
[2] SINGH K, SINGH P, KUMAR K. User Behavior Analytics-Based Classification of Application Layer HTTP-GET Flood Attacks [J]. Journal of Network and Computer Applications, 2018, 112 (15): 97-114.
[3] SHASHANKA M, SHEN M-Y, WANG J. User and entity behavior analytics for enterprise security [C] // IEEE International Conference on Big Data. Washington, DC, USA: IEEE, 2016: 1867-1874.
[4] GUPTA R, TANWAR S, TYAGI S, et al. Machine Learning Models for Secure Data Analytics: A taxonomy and threat model [J]. Computer Communications, 2020, 153: 406-440.
[5] WEN Yu, WANG W, MENG D. Mining User Cross-Domain Behavior Patterns for Insider Threat Detection [J]. Chinese Journal of Computers, 2016, 39 (8): 1555-1569.
[6] LI Z, SONG L. Research on internal threat detection based on user window behavior [J]. Computer Engineering, 2020, 46 (4): 135-142, 150.
[7] YANG A, ZHUANSUN Y, LIU C, et al. Design of Intrusion Detection System for Internet of Things Based on Improved BP Neural Network [J]. IEEE Access, 2019, 7: 106043-106052.
[8] AHMIM A, DERDOUR M, FERRAG M A. An intrusion detection system based on combining probability predictions of a tree of classifiers [J]. International Journal of Communication Systems, 2018, 31 (9): 1-17.
[9] BELOUCH M, EL S, IDHAMMAD M. A Two-Stage Classifier Approach using RepTree Algorithm for Network Intrusion Detection [J]. International Journal of Advanced Computer Science and Applications, 2017, 8 (6): 389-394.
[10] SHAILENDRA SINGH, ABDULSALAM YASSINE. Big Data Mining of Energy Time Series for Behavioral Analytics and Energy Consumption Forecasting [J]. Energies, 2018, 11 (2): 1-26.
[11] Gartner, ‘Market Guide for User and Entity Behavior Analytics’, Gartner, 2019. https://www.gartner.com/en/documents/3917096.
[12] MIAH S J, VU H Q, GAMMACK J, et al. A Big Data Analytics Method for Tourist Behaviour Analysis [J]. Information & Management, 2017, 54 (6): 771-785.
[13] WANG K, ZHENG H, LOURI A. TSA-NoC: Learning-Based Threat Detection and Mitigation for Secure Network-on-Chip Architecture [J]. IEEE Micro, 2020, 40 (5): 56-63.
[14] XU S, QIAN Y, HU R Q. Edge Intelligence Assisted Gateway Defense in Cyber Security [J]. IEEE Network, 2020, 34 (4): 14-19.
[15] Mo Fan, He Shuai, Sun Jia, Fan Yuan, and Liu Bo, "Application of user entity behavior analysis technology based on Machine learning in account anomaly detection," Communications Technology, Vol. 53, No. 5, pp. 1262 -- 1267, 2020.
[16] Xu Fei, "Status and Development Analysis of network security Situation Awareness Technology Based on UEBA," Network Security Technology and Application, No. 10, pp. 10 -- 13, 2020.
[17] Shaoyong Hu, "Data Leakage Analysis Based on UEBA," Information Security and Communication Confidentiality, No. 8, PP. 26-28. 2018.
[18] Liu Jin, Li Jiangbo, and Ye Bing, "Research on the Internal Control Risk Management of UEBA Data Security," Cyberspace Security, Vol. 12, No. Z3, pp. 43-48 +55, 2021.
[19] Cui Jing-yang, Chen Zhen-guo, Tian Li-qin, and Zhang Guang-hua, "A survey of user and entity behavior analysis techniques based on Machine learning," Computer Engineering, pp. 1-20, 2021, doi: 10.19678/j.issn.1000-3428.0062623.
[20] A. Rodriguez and A. Laio, “Clustering by fast search and find of density peaks,” Science, vol. 344, no. 6191, pp. 1492-1496, June 2014, doi: 10.1126/science.1242072.
[21] S. Liu, ‘Adaptive Mixed-Attribute Data Clustering Method Based on Density Peaks’, Complexity, p. 13, 2022.
[22] M. Du, S. Ding and H. Jia, “Study on density peaks clustering based on k-nearest neighbors and principal component analysis”, Knowledge-Based Systems, vol. 99, pp. 135-145, May 2016, doi: 10.1016/j.knosys.2016.02.001.
Cite This Article
  • APA Style

    Shihua Liu. (2022). User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering. International Journal of Data Science and Analysis, 8(5), 163-168. https://doi.org/10.11648/j.ijdsa.20220805.17

    Copy | Download

    ACS Style

    Shihua Liu. User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering. Int. J. Data Sci. Anal. 2022, 8(5), 163-168. doi: 10.11648/j.ijdsa.20220805.17

    Copy | Download

    AMA Style

    Shihua Liu. User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering. Int J Data Sci Anal. 2022;8(5):163-168. doi: 10.11648/j.ijdsa.20220805.17

    Copy | Download

  • @article{10.11648/j.ijdsa.20220805.17,
      author = {Shihua Liu},
      title = {User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering},
      journal = {International Journal of Data Science and Analysis},
      volume = {8},
      number = {5},
      pages = {163-168},
      doi = {10.11648/j.ijdsa.20220805.17},
      url = {https://doi.org/10.11648/j.ijdsa.20220805.17},
      eprint = {https://article.sciencepublishinggroup.com/pdf/10.11648.j.ijdsa.20220805.17},
      abstract = {In the era of digital economy, new technologies emerge in an endless stream, and the network environment becomes increasingly complex. Traditional security products, technologies and solutions cannot meet the needs. In order to deal with the increasingly severe network security challenges, User and Entity Behavior Analytics (UEBA) technology provides a new solution. The application of new technologies such as statistical analysis, machine learning and deep learning also increases the adaptability and effectiveness of UEBA technology. User and entity behavior analysis technology based on machine learning has also become one of the research hotspots in current academia. In this paper, An User and Entity Behavior Analytics Method based on Adaptive Mixed-Attribute-Data Density Peaks Clustering is proposed. Firstly, the relevant access behavior data records of user entities are extracted from the access logs of the servers that need to be monitored. Since these records contain mixed attributes, adaptive mixed-attribute-data density peak clustering (AMDPC) can be used for clustering. Then, by constructing the user behavior baseline in each cluster, suspicious users and behaviors are analyzed. Combined with log backtracking and expert manual verification, the threat behavior is finally determined. This method has been applied in a company's network security situation awareness platform, and has achieved good practical results.},
     year = {2022}
    }
    

    Copy | Download

  • TY  - JOUR
    T1  - User and Entity Behavior Analytics Method Based on Adaptive Mixed-Attribute-Data Density Peaks Clustering
    AU  - Shihua Liu
    Y1  - 2022/10/29
    PY  - 2022
    N1  - https://doi.org/10.11648/j.ijdsa.20220805.17
    DO  - 10.11648/j.ijdsa.20220805.17
    T2  - International Journal of Data Science and Analysis
    JF  - International Journal of Data Science and Analysis
    JO  - International Journal of Data Science and Analysis
    SP  - 163
    EP  - 168
    PB  - Science Publishing Group
    SN  - 2575-1891
    UR  - https://doi.org/10.11648/j.ijdsa.20220805.17
    AB  - In the era of digital economy, new technologies emerge in an endless stream, and the network environment becomes increasingly complex. Traditional security products, technologies and solutions cannot meet the needs. In order to deal with the increasingly severe network security challenges, User and Entity Behavior Analytics (UEBA) technology provides a new solution. The application of new technologies such as statistical analysis, machine learning and deep learning also increases the adaptability and effectiveness of UEBA technology. User and entity behavior analysis technology based on machine learning has also become one of the research hotspots in current academia. In this paper, An User and Entity Behavior Analytics Method based on Adaptive Mixed-Attribute-Data Density Peaks Clustering is proposed. Firstly, the relevant access behavior data records of user entities are extracted from the access logs of the servers that need to be monitored. Since these records contain mixed attributes, adaptive mixed-attribute-data density peak clustering (AMDPC) can be used for clustering. Then, by constructing the user behavior baseline in each cluster, suspicious users and behaviors are analyzed. Combined with log backtracking and expert manual verification, the threat behavior is finally determined. This method has been applied in a company's network security situation awareness platform, and has achieved good practical results.
    VL  - 8
    IS  - 5
    ER  - 

    Copy | Download

Author Information
  • School of Artificial Intelligence, Wenzhou Polytechnic, Wenzhou, China

  • Sections