User Behavior Analytics algorithms in practice « DanielBago@Balabit Blog

In my first blogpost, I introduced the basic concept of machine learning and how it contributes to the world of IT security. Now I want to dig deeper and showcase those machine learning algorithms used by Blindspotter, BalaBit's user behavior analytics tool. Blindspotter does not rely on a single "silver bullet of algorithms", but combines eight algorithms to achieve better predictive performance. A well-disguised and well-prepared insider or external attacker may deceive one, two or in rare cases even three algorithms, but it is more than improbable that he or she would able to deceive all of them. Let's see an example, in which Mallory, the malicious senior sysadmin tries to steal valuable intellectual property of her employer and sell it to a competitor. Blindspotter's main concept is the prioritization of security incidents and events.