User and entity behavioral analysis using an advanced cyber decision platform
A cybersecurity system that protects against cyber attacks by performing user and device behavioral analysis using an advanced cyber decision platform which creates a map of users and devices attached to a network, develops a baseline of expected interactions and behaviors for each user and device in the map, and monitors deviations from the expected interactions and behaviors.
1. A system for user and entity behavioral analysis using an advanced cyber decision platform, comprising:
a computing device comprising a memory and a processor;
a grouping engine comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
create an interaction dataset based at least in part on interactions of users and devices within a network;
process the interaction dataset with at least graph analysis to generate an interaction map;
store the interaction dataset and interaction map; and
create a plurality of groups from the users and devices within the network based at least in part on the interaction map;
a behavioral analysis engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
create a network-usage dataset based at least in part on access logs of the users and devices within the network;
process the network-usage dataset to generate a behavioral baseline for each of the previously created groups; and
store the network-usage dataset and behavioral baseline; and
a monitoring service comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
continuously monitor each group for anomalous network behavior based at least on the behavioral baseline;
periodically create and store a behavioral analysis snapshot of the users and devices within the network;
receive an identified vulnerability and an identified extent to which the network may be compromised from a simulation engine;
improve the security of the network by changing an access privilege of one or more of the users and devices on the network based on the identified vulnerability and identified extent; and
a simulation engine comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
retrieve the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot from storage;
run a simulation comprising a simulated cyber-attack of a particular type on the network using the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot;
identify a vulnerability of the network to the simulated cyber-attack of a particular type;
identify an extent to which the network may be compromised based on the simulated cyber-attack of a particular type;
send the identified vulnerability and identified extent to the monitoring service.
2. The system of claim 1 , wherein a corrective measure is automatically located and applied in the event of anomalous behavior detection.
3. The system of claim 1 , wherein the grouping engine dynamically adjusts groups based on changing group dynamics.
4. The system of claim 1 , wherein at least a portion of the interaction dataset is based on results of natural language processing of internal communications.
5. The system of claim 1 , wherein the behavioral analysis snapshot is used in forecasting group dynamic.
6. A method for user and entity behavioral analysis using an advanced cyber decision platform, comprising the steps of:
creating an interaction dataset based at least in part on interactions of users and devices within a network using a grouping engine;
processing the interaction dataset with at least graph analysis to generate an interaction map using the grouping engine;
storing the interaction dataset and interaction map;
creating a plurality of groups from the users and devices within the network based at least in part on the interaction map using the grouping engine;
creating a network-usage dataset based at least in part on access logs of the users and devices within the network using a behavioral analysis engine;
processing the network-usage dataset to generate a behavioral baseline for each of the previously created groups using the behavioral analysis engine;
storing the network-usage dataset and behavioral baseline;
continuously monitoring each group for anomalous network behavior based at least on the behavioral baseline using a monitoring service;
periodically creating and storing a behavioral analysis snapshot of the users and devices within the network;
retrieving the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot from storage;
running a simulation comprising a simulated cyber-attack of a particular type on the network using the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot;
identifying a vulnerability of the network to the simulated cyber-attack of a particular type;
identifying an extent to which the network may be compromised based on the simulated cyber-attack of a particular type;
sending the identified vulnerability and identified extent to the monitoring service; and
improving the security of the network by changing an access privilege of one or more of the users and devices based on the identified vulnerability and identified extent.
7. The method of claim 6 , wherein a corrective measure is automatically located and applied in the event of anomalous behavior detection.
8. The method of claim 6 , wherein the grouping engine dynamically adjusts groups based on changing group dynamics.
9. The method of claim 6 , wherein at least a portion of the interaction dataset is based on results of natural language processing of internal communications.
10. The method of claim 6 , wherein the behavioral analysis snapshot is used in forecasting group dynamic.