MITRE D3FENDdefensive technique
D3-UBA User Behavior Analysis
- Tactic
- Detect
- Synonyms
- Credential Monitoring, UBA
Definition
User behavior analytics ("UBA") as defined by Gartner, is a cybersecurity process about detection of insider threats, targeted attacks, and financial fraud. UBA solutions look at patterns of human behavior, and then apply algorithms and statistical analysis to detect meaningful anomalies from those patterns-anomalies that indicate potential threats.' Instead of tracking devices or security events, UBA tracks a system's users. Big data platforms are increasing UBA functionality by allowing them to analyze petabytes worth of data to detect insider threats and advanced persistent threats.
How it works
Technique Overview
Some techniques monitor patterns of human behavior and then apply algorithms and to identify patterns such as repeated login attempts from a single IP address or large file downloads, or abnormal accesses.
Other techniques may have explicit or rigid definitions of "bad behavior" which are then matched against instances in a computer network environment.
Related
Referenced by MITRE D3FEND · child of (11)
- D3-ANET Authentication Event Thresholding defensive technique
- D3-AZET Authorization Event Thresholding defensive technique
- D3-CCSA Credential Compromise Scope Analysis defensive technique
- D3-DAM Domain Account Monitoring defensive technique
- D3-JFAPA Job Function Access Pattern Analysis defensive technique
- D3-LAM Local Account Monitoring defensive technique
- D3-RAPA Resource Access Pattern Analysis defensive technique
- D3-SDA Session Duration Analysis defensive technique
- D3-UDTA User Data Transfer Analysis defensive technique
- D3-UGLPA User Geolocation Logon Pattern Analysis defensive technique
- D3-WSAA Web Session Activity Analysis defensive technique