Anomaly Detection and Enterprise Security using User and Entity Behavior Analytics (UEBA)
Abstract
Digital frauds are made possible by a lack of transparency and other security flaws in a system. Consequently, it has grown to be the most pervasive problem in the world. When these frauds emerge from within businesses, they are referred to as insider threats and may lead to severe consequences. There have been various frameworks proposed to lessen this problem, however, transparency still remains a challenge. Conventionally, storing data in chronological order to prevent data manipulation is one technique to ensure traceability and security. In this paper, we present a framework based on User Entity and Behavioral Analysis (UEBA) approach to study user profiles over time and classify them as normal or aberrant. The proposed framework utilises additional information including IP addresses, location data, and the users’ organizations etc. We focus on applying data science and analytical methods to create data visualizations for analysis and anomaly identification.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Adaptability of insider threat detection systems to organizational dynamics is crucial, because shifts in structures, roles, and responsibilities impact the efficacy of detection mechanisms.
“The adaptability of insider threat detection systems to organizational dynamics is crucial. Organizations often experience shifts in structures, roles, and responsibilities, impacting the efficacy of detection mechanisms. Addressing this challenge involves designing systems that can dynamically adapt to changes, automate role-based access adjustments, and minimize false positives during structural”
From A Review of Recent Advances, Challenges, and Opportunities in Malicious Insider Threat Detection Using Machine Learning Methods (2024) · cites this paper as [30]
Cites
Human factors in information security: The insider threat – Who can you trust these days?
Colwill, C. (2009) · Information Security Technical Report · doi:10.1016/j.istr.2010.04.004 · Cited by 319 · see citing works
Behavioral Based Insider Threat Detection Using Deep Learning
Nasir, R., Afzal, M., Latif, R., & Iqbal, W. (2021) · IEEE Access · doi:10.1109/access.2021.3118297 · Cited by 146 · see citing works
A new intelligent multilayer framework for insider threat detection
Al-Mhiqani, M. N., Ahmad, R., Abidin, Z. Z., Abdulkareem, K. H., Mohammed, M. A., Gupta, D., & Shankar, K. (2022) · Computers and Electrical Engineering · doi:10.1016/j.compeleceng.2021.107597 · Cited by 87 · see citing works
Deep Learning Based Attribute Classification Insider Threat Detection for Data Security
Meng, F., Lou, F., Fu, Y., & Tian, Z. (2018) · 2018 IEEE Third International Conference on Data Science in Cyberspace (DSC) · doi:10.1109/dsc.2018.00092 · Cited by 74 · see citing works
Detecting Insider Threat via a Cyber-Security Culture Framework
Georgiadou, A., Mouzakitis, S., & Askounis, D. (2022) · Journal of Computer Information Systems · doi:10.1080/08874417.2021.1903367 · Cited by 65 · see citing works
Classifier Suites for Insider Threat Detection
Noever, D. (2019) · arXiv · doi:10.48550/arxiv.1901.10948 · Cited by 16 · see citing works
Flagged first, then by citations
Cited by
Sorted by citations
Alzaabi, F. R., & Mehmood, A. (2024) · IEEE Access · doi:10.1109/access.2024.3369906 · Cited by 204 · see citing works
“By stitching these perspectives together, a holistic understanding of user behavior emerges, revealing the full context of potential threats as demonstrated in [30].”
Background
- Authors
- Zunair Ahmed Khan, M., Mubashir Khan, M., & Arshad, J.
- Affiliations
- NED University of Engineering & Technology,Department of Computer Science & IT,Karachi,Pakistan
- Birmingham City University (GB)
- ORCID
- Arshad, Junaid
- Venue
- 2022 3rd International Conference on Innovations in Computer Science & Software Engineering (ICONICS)
- Publisher
- IEEE
- Published
- 2022-12-14
- Pages
- 1-9
- OpenAlex
- W4366674740
- Cited by
- 19
- References
- 6
- Citations by year
- 2026: 5 · 2025: 5 · 2024: 8 · 2023: 1
- FWCI
- 3.39
- Type
- conference paper
- Language
- en
- Open access
- closed
- Locations
- International Conference on Innovations in Computer Science & Software Engineering (ICONICS) (publishedVersion)
- Funders
- Birmingham City University
- Topics
- Physical Sciences › Computer Science › Computer Networks and Communications › Network Security and Intrusion Detection
- Physical Sciences › Computer Science › Artificial Intelligence › Anomaly Detection Techniques and Applications
- Physical Sciences › Computer Science › Information Systems › User Authentication and Security Systems
- Keywords
- user and entity behavior analytics, anomaly detection, insider threats, enterprise security, digital fraud, user profiling, IP address analysis, location data, data traceability, data visualization
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
