Cyber Semantic Account Management User Behavior Modeling, Visualization and Monitoring
Keith D. Shapiro · 2011
The research described in this paper presents an automated approach to generating and visualizing user behavior profiles based on activity observed in a networked environment. Derived (initially) from access log data, these profiles can serve as a model of expected behavior. Deviations from expected behavior can be identified by comparing benchmark profiles to profiles based on recent activity. This approach represents a practical solution to the problem of identifying malicious activity associated with compromised log-in credentials or insider attack. In those types of attacks, traditional defensive measures often fall short as the user was granted access to the system via normal channels using valid credentials.