USER

BEHAVIOURAL
ANALYTICS
Machine Learning for Threat Detection
Harry McLaren – Security Consultant at ECS
 HARRY MCLAREN

• Alumnus of Edinburgh Napier

• Security Consultant at ECS
• SOC & CSIR Development
• Splunk Consultant & Architect
 ACCELERATING PACE OF DATA
Volume | Velocity | Variety | Variability
Legacy SIEM type technologies aren’t
enough to detect insider threats and
advanced adversaries and are poorly
designed for rapid incident response.

[SIEM - Security Information & Event Management]

 Inadequate
Contextual Data
68% of respondents in
the survey said that
reports often only
indicated changes
without specifying what
the change was.
Innocuous
Events of Interest
81% of respondents said
that SIEM reports contain
too much extraneous
information and were
overwhelmed with
false positives.

2016 SIEM Efficiency Survey - Conducted by Netwrix

 2015

TECHNOLOGY
DEVELOPMENT
2011
CAPABILITY

2008

2002
1995

END-POINT SECURITY NETWORK SECURITY EARLY CORRELATION PAYLOAD ANALYSIS BEHAVIOR ANALYSIS

EVOLUTION
KILL CHAIN - EVENTS OVERLOAD
 SECURITY PLATFORM

INCIDENT SECURITY & REAL-TIME DETECTING DETECTION OF DETECTION OF

INVESTIGATIONS & COMPLIANCE MONITORING OF UNKNOWN THREATS ADVANCED INSIDER THREATS
FORENSICS REPORTING KNOWN THREATS CYBER ATTACKS

Splunk Enterprise Security Splunk UBA

 MACHINE LEARNING UNSUPERVISED MACHINE
LEARNING

EVOLUTION
COMPLEXITY

SUPERVISED MACHINE
LEARNING

POLICY - PEER GROUP

STATISTICS
POLICY - STATISTICS

POLICY - THRESHOLD
RULES - THRESHOLD

EVOLUTION
 WHAT IS SPLUNK
USER BEHAVIORAL ANALYTICS?
DETECT ADVANCED CYBERATTACKS

DETECT MALICIOUS INSIDER THREATS

REAL-TIME & BEHAVIOR UNSUPERVISED ANOMALY THREAT

BIG DATA BASELINING & MACHINE DETECTION DETECTION
ARCHITECTURE MODELING LEARNING
 USER ACTIVITY
Day 1 John connects via VPN

Day 2 John elevates his privileges

.
INSIDER
John executes remote desktop to a system
(administrator) - PCI zone

.
THREAT Administrator performs ssh (root) to a file share
- finance department

. root accesses a sensitive document

from the file share

. root copies the document to another file share

- Corporate zone

root uses a set of Twitter handles to chop and

Day N
copy the data outside the enterprise
 MULTI-ENTITY BEHAVIORAL MODEL
NETWORK

APPLICATION

HOST

DATA

USER
 UBA 2.2 LATEST FEATURES
• Threat Modeling Framework
• Create custom threats using 60+ anomalies.
• Enhanced Security Analytics
• Visibility and baseline metrics around user,
device, application and protocols.
• Risk Percentile & Dynamic Peer Groups
• Support for Additional 3rd Party Devices
 QUESTIONS / CONTACT

harry.mclaren@ecs.co.uk

twitter.com/cyberharibu

harrymclaren.co.uk/blog