User behavior analytics (UBA) has been a hot topic in IT security for some time now. With successful deployment of perimeter defense, companies must now address the threat within. This threat, whether from a rogue employee, careless business partner or external actor with compromised credentials, is real and often difficult to detect.

The effects of this threat can be devastating for a company, either in loss of intellectual property, a drop in customer confidence or damage to its brand and reputation. For example, the attack on the electrical grid in Ukraine and the resulting blackout for over 200,000 customers all started with an infected Word document being opened by an insider.

QRadar UBA App Reveals Anomalous Activities

To counter this threat, clients are increasingly adopting UBA solutions. In fact. the IBM QRadar UBA app is the most popular platform on the IBM Security App Exchange. With over 4,000 downloads, clients are deploying this app to identify and detect anomalous activities among their users.

Our clients reported many interesting behavior patterns they detected using QRadar UBA, including:

  • User admins changing other people’s attributes without proper permissions;
  • Users sharing virtual private network (VPN) credentials;
  • Devices being taken out of the country when users are on vacation;
  • Contractors in North America checking messages and emails in cloud services and then the same accounts being accessed from abroad within minutes;
  • Security operations center (SOC) analyst accounts infected with malware;
  • Detected misconfiguration of other security tools;
  • Users opening personal accounts on servers; and
  • A higher-than-expected number of logins from machine accounts.

Rules Were Made to Be Broken

Until relatively recently, security software relied on rules-based analytics to detect anomalies and bring them to the attention of SOC analysts. Rules are great because they are clear, precise and can easily be written and implemented, but they have their limitations.

For one, they can generate a lot of false positives. More importantly, you can only write a rule for a threat that is known or an attack pattern that can be predicted. What do you do when a new threat emerges? You are essentially unprotected until the threat becomes known.

Monitoring User Behavior With Machine Learning

This is where machine learning can help. It can understand the normal behavior of a user and can identify meaningful deviations. The upcoming release of IBM QRadar UBA (version 2.0) includes machine learning algorithms to detect anomalous activities and suspicious behavior.

These machine learning algorithms will detect temporal or time series anomalies. They monitor users across multiple dimensions and create a model for normal pattern of activities, asset usage and network communications. These individual user models can then be leveraged to determine when a user begins to do something new. The algorithms detect and flag the anomalous activity, triggering the UBA app to raise the risk score of the users or raise an offense when appropriate.

Reducing False Positives

By monitoring each user activity, the tool can identify any roles that individual has within the organization and assign people into role-based peer groups. New behaviors that deviate from these roles can be detected and may be early indicators of malicious intent.

The algorithms work independently and examine users’ activities from several perspectives to reduce the number of false positives. They address a broad range of use cases, including:

  • Change in users’ activity without change in associated frequency;
  • Change in frequency of activity without any change in the activity itself;
  • Change in the time window of user activity;
  • Slow encroachment of data over a long period; and
  • Data exfiltration from a device or through the network.

Strengthening the SOC

Version 2.0 of IBM QRadar UBA will enable SOC analysts to:

  • Improve threat detection by using built-in machine learning algorithms that continually adjust and tune to each user’s normal behavior.
  • Improve SOC operations by reducing offense fatigue while boosting efficient detection and investigation of suspicious activities.
  • Present real-time insights into the risk posture of the monitored users and environment.

With the security intelligence and threat detection capabilities of QRadar UBA, IT professionals are better equipped to keep pace with malicious insiders, external fraudsters and the ever-evolving cybercrime landscape.

Learn More About User Behavior Analytics and download the UBA App

More from Intelligence & Analytics

The 13 Costliest Cyberattacks of 2022: Looking Back

2022 has shaped up to be a pricey year for victims of cyberattacks. Cyberattacks continue to target critical infrastructures such as health systems, small government agencies and educational institutions. Ransomware remains a popular attack method for large and small targets alike. While organizations may choose not to disclose the costs associated with a cyberattack, the loss of consumer trust will always be a risk after any significant attack. Let’s look at the 13 costliest cyberattacks of the past year and…

What Can We Learn From Recent Cyber History?

The Center for Strategic and International Studies compiled a list of significant cyber incidents dating back to 2003. Compiling attacks on government agencies, defense and high-tech companies or economic crimes with losses of more than a million dollars, this list reveals broader trends in cybersecurity for the past two decades. And, of course, there are the headline breaches and supply chain attacks to consider. Over recent years, what lessons can we learn from our recent history — and what projections…

When Logs Are Out, Enhanced Analytics Stay In

I was talking to an analyst firm the other day. They told me that a lot of organizations purchase a security information and event management (SIEM) solution and then “place it on the shelf.” “Why would they do that?” I asked. I spent the majority of my career in hardware — enterprise hardware, cloud hardware, and just recently made the jump to security software, hence my question. “Because SIEMs are hard to use. A SIEM purchase is just a checked…

4 Most Common Cyberattack Patterns from 2022

As 2022 comes to an end, cybersecurity teams globally are taking the opportunity to reflect on the past 12 months and draw whatever conclusions and insights they can about the threat landscape. It has been a challenging year for security teams. A major conflict in Europe, a persistently remote workforce and a series of large-scale cyberattacks have all but guaranteed that 2022 was far from uneventful. In this article, we’ll round up some of the most common cyberattack patterns we…