Historically, cybersecurity has solely used rule-driven frameworks to detect potential cyber threats. An example of this is if a large amount of data is downloaded in the middle of the night. This action might trigger a rule violation which would alert the security team. This rule-based approach is still an important part of a layered analytics security approach today; however, smart hackers can avoid triggering many of the rules that are set up in these systems and it can be hard to find employees acting in a malicious manner (otherwise known as insider threats). Behavioral analytics enables a people-centric defense by using complex machine learning algorithms to analyze user and entity data across an enterprise and identify unexpected behavior that may be an indication of a security breach.
In cybersecurity, behavioral analytics is often called user and entity behavior analytics or UEBA. UEBA has grown in popularity because it can sift through most of an organization’s data to develop high quality leads for security analysts to evaluate which saves significant time and money. UEBA can also reduce the amount of security analysts which can reduce pressure from companies to participate in the very competitive security talent war.
One of the biggest applications of behavioral analytics in security is detecting insider threats. Insider threats are attacks from employees of an organization motivated either by monetary gain or retribution against the company. Since employees already have access to sensitive information that they use in their job, no hacking is required to steal that information from the company. Therefore, security rules are often not triggered. Behavioral analytics, however, can be used to identify and alert the security team to unusual behavior exhibited by employees.
Video: ArcSight for Preemptive Threat Detection
Another common application of behavioral analytics in security is detecting advanced persistent threats (APTs). APTs occur when a hacker gains access to an organization’s server for an extended period of time. These attacks are especially difficult to detect using conventional methods because APTs are consciously designed to avoid triggering common rules so as to ensure longevity in their access. Behavioral analytics, however, are able to detect APTs since their algorithms monitor activity that is out of the ordinary that would be exhibited by APTs.
The last application of UEBA software that is very common is detecting zero-day attacks. Zero-day attacks are new attacks that have not been used before and therefore will have no rules written to detect them. Because behavioral analysis uses previous behavioral data to evaluate what is not normal, these new attacks can often be detected because they generally use new executables and methods that are out of the ordinary in order to breach a company’s security.