User behavior analytics (UBA) has been a hot topic in IT security for some time now. With successful deployment of perimeter defense, companies must now address the threat within. This threat, whether from a rogue employee, careless business partner or external actor with compromised credentials, is real and often difficult to detect.

The effects of this threat can be devastating for a company, either in loss of intellectual property, a drop in customer confidence or damage to its brand and reputation. For example, the attack on the electrical grid in Ukraine and the resulting blackout for over 200,000 customers all started with an infected Word document being opened by an insider.

QRadar UBA App Reveals Anomalous Activities

To counter this threat, clients are increasingly adopting UBA solutions. In fact. the IBM QRadar UBA app is the most popular platform on the IBM Security App Exchange. With over 4,000 downloads, clients are deploying this app to identify and detect anomalous activities among their users.

Our clients reported many interesting behavior patterns they detected using QRadar UBA, including:

• User admins changing other people’s attributes without proper permissions;
• Users sharing virtual private network (VPN) credentials;
• Devices being taken out of the country when users are on vacation;
• Contractors in North America checking messages and emails in cloud services and then the same accounts being accessed from abroad within minutes;
• Security operations center (SOC) analyst accounts infected with malware;
• Detected misconfiguration of other security tools;
• Users opening personal accounts on servers; and
• A higher-than-expected number of logins from machine accounts.

Rules Were Made to Be Broken

Until relatively recently, security software relied on rules-based analytics to detect anomalies and bring them to the attention of SOC analysts. Rules are great because they are clear, precise and can easily be written and implemented, but they have their limitations.

For one, they can generate a lot of false positives. More importantly, you can only write a rule for a threat that is known or an attack pattern that can be predicted. What do you do when a new threat emerges? You are essentially unprotected until the threat becomes known.

Monitoring User Behavior With Machine Learning

This is where machine learning can help. It can understand the normal behavior of a user and can identify meaningful deviations. The upcoming release of IBM QRadar UBA (version 2.0) includes machine learning algorithms to detect anomalous activities and suspicious behavior.

These machine learning algorithms will detect temporal or time series anomalies. They monitor users across multiple dimensions and create a model for normal pattern of activities, asset usage and network communications. These individual user models can then be leveraged to determine when a user begins to do something new. The algorithms detect and flag the anomalous activity, triggering the UBA app to raise the risk score of the users or raise an offense when appropriate.

Reducing False Positives

By monitoring each user activity, the tool can identify any roles that individual has within the organization and assign people into role-based peer groups. New behaviors that deviate from these roles can be detected and may be early indicators of malicious intent.

The algorithms work independently and examine users’ activities from several perspectives to reduce the number of false positives. They address a broad range of use cases, including:

• Change in users’ activity without change in associated frequency;
• Change in frequency of activity without any change in the activity itself;
• Change in the time window of user activity;
• Slow encroachment of data over a long period; and
• Data exfiltration from a device or through the network.

Strengthening the SOC

Version 2.0 of IBM QRadar UBA will enable SOC analysts to:

• Improve threat detection by using built-in machine learning algorithms that continually adjust and tune to each user’s normal behavior.
• Improve SOC operations by reducing offense fatigue while boosting efficient detection and investigation of suspicious activities.
• Present real-time insights into the risk posture of the monitored users and environment.

With the security intelligence and threat detection capabilities of QRadar UBA, IT professionals are better equipped to keep pace with malicious insiders, external fraudsters and the ever-evolving cybercrime landscape.

Learn More About User Behavior Analytics and download the UBA App