MITRE D3FENDdefensive technique
D3-JFAPA Job Function Access Pattern Analysis
- Tactic
- Detect
Definition
Detecting anomalies in user access patterns by comparing user access activity to behavioral profiles that categorize users by role such as job title, function, department.
How it works
How it works
Peer group analysis identifies functionally similar groups of actors (users or resources) based on categorizations such as job title, organizational hierarchy, or other attribute that indicates similarity of job function. Current user access activity is then compared to the appropriate peer group behavior profile to identify anomalies.
Considerations
Potential for false positives from anomalies that are not associated with malicious activity.
Related
Child of · MITRE D3FEND (1)
- D3-UBA User Behavior Analysis defensive technique
References
- https://patents.google.com/patent/US20160226901A1 Anomaly Detection Using Adaptive Behavioral Profiles