Real-Time User and Entity Behavior Analytics (UEBA) for Insider Threat Detection

Abstract

Enterprises today face serious risks from insider employees whose malicious activities can cause heavy financial and reputational damage. Traditional insider threat detection methods mostly highlight abnormal users or abnormal time periods (like a day or a week). However, in practice, a single user may generate thousands of events in just one day, making it costly and timeconsuming to manually verify suspicious cases. Furthermore, most existing studies are post-hoc, meaning they analyze logs only after the incident, which fails to prevent losses in real time. To address recent research like a paper at the 2024 LAN conference proposed a finegrained approach. Activity-level framework for real-time insider threat detection using graph neural networks. Their learning model learns both the structure of a language and the meanings of the symbols within it. temporal order of activities and the relationships across sequences In order to tackle data imbalance, a hybrid loss function should also be used. Nine state-of-the-art approaches have been surpassed by the LAN in terms of results obtained. The use of the CLEVR dataset improved the AUC score by 5.8% and the CERT r4.2 and r5.2 datasets by almost 8% and 7.1% respectively over a baseline model. 10%. Building on this, our project proposes a hybrid GraphSAGE+ GAT model for real-time User and Entity Behavior Analytics Our system, as opposed to other network systems, concentrates on scalability in terms of the number of users and network size. interpretability, and reduction of false positives. By combining GraphSAGE's efficient neighbor sampling with GAT's attention mechanism, we design a framework that not only detects insider threats in real time but also explains why a user was flagged, making it more practical for Security Operation Centers (SOCs).