Framework for behavioral analytics in anomaly identification

Maroun Touma; Elisa Bertino; Brian Rivera; Dinesh Verma; Seraphin Calo

doi:10.1117/12.2266374

4 May 2017 Framework for behavioral analytics in anomaly identification

Maroun Touma, Elisa Bertino, Brian Rivera, Dinesh Verma, Seraphin Calo

Proceedings Volume 10190, Ground/Air Multisensor Interoperability, Integration, and Networking for Persistent ISR VIII; 101900H (2017) https://doi.org/10.1117/12.2266374
Event: SPIE Defense + Security, 2017, Anaheim, CA, United States

Abstract

Behavioral Analytics (BA) relies on digital breadcrumbs to build user profiles and create clusters of entities that exhibit a large degree of similarity. The prevailing assumption is that an entity will assimilate the group behavior of the cluster it belongs to. Our understanding of BA and its application in different domains continues to evolve and is a direct result of the growing interest in Machine Learning research. When trying to detect security threats, we use BA techniques to identify anomalies, defined in this paper as deviation from the group behavior. Early research papers in this field reveal a high number of false positives where a security alert is triggered based on deviation from the cluster learned behavior but still within the norm of what the system defines as an acceptable behavior. Further, domain specific security policies tend to be narrow and inadequately represent what an entity can do. Hence, they: a) limit the amount of useful data during the learning phase; and, b) lead to violation of policy during the execution phase. In this paper, we propose a framework for future research on the role of policies and behavior security in a coalition setting with emphasis on anomaly detection and individual's deviation from group activities.

Conference Presentation

Citation Download Citation

Maroun Touma, Elisa Bertino, Brian Rivera, Dinesh Verma, and Seraphin Calo "Framework for behavioral analytics in anomaly identification", Proc. SPIE 10190, Ground/Air Multisensor Interoperability, Integration, and Networking for Persistent ISR VIII, 101900H (4 May 2017); https://doi.org/10.1117/12.2266374

ACCESS THE FULL ARTICLE

INSTITUTIONAL
Select your institution to access the SPIE Digital Library.

SELECT YOUR INSTITUTION

PERSONAL
Sign in with your SPIE account to access your personal subscriptions or to use specific features such as save to my library, sign up for alerts, save searches, etc.

PERSONAL SIGN IN

No SPIE Account? Create one

PURCHASE THIS CONTENT

SUBSCRIBE TO DIGITAL LIBRARY

50 downloads per 1-year subscription

Members: $195

Non-members: $335 ADD TO CART

25 downloads per 1 - year subscription

Members: $145

Non-members: $250 ADD TO CART

PURCHASE SINGLE ARTICLE

Includes PDF, HTML & Video, when available