基于机器学习的用户与实体行为分析技术综述

Overview of User and Entity Behavior Analytics Technology Based on Machine Learning

随着网络安全技术的更新迭代,新型攻击手段日益增加,企业面临未知威胁难以识别的问题。用户与实体行为分析是识别用户和实体行为中潜在威胁事件的一种异常检测技术,广泛应用于企业内部威胁分析和外部入侵检测等任务。基于机器学习方法对用户和实体的行为进行模型建立与风险点识别,可以有效解决未知威胁难以检测的问题,增强企业网络安全防护能力。回顾用户与实体行为分析的发展历程,重点讨论用户与实体行为分析技术在统计学习、深度学习、强化学习等3个方面的应用情况,研究具有代表性的用户与实体行为分析算法并对算法性能进行对比分析。介绍4种常用的公共数据集及特征工程方法,总结两种增强行为表述准确性的特征处理方式。在此基础上,阐述归纳典型异常检测算法的优劣势,指出内部威胁分析与外部入侵检测的局限性,并对用户与实体行为分析技术未来的发展方向进行展望。

With the continuous development of network security technology,new attacking methods are becoming increasingly numerous,exposing enterprises to unknown threats that are difficult to identify.User Entity Behavior Analytics(UEBA)is an anomaly detection technology to identify potential threat events in user and entity behavior.It has been widely used in external intrusion detection and internal threat analysis of enterprises.By using machine learning methods to model user and entity behavior and identify risk points,UEBA can address unknown threats that are difficult to detect,and enhance the defense of enterprise networks.This paper introduces the development history of UEBA,and discusses its applications in statistical learning,deep learning and reinforcement learning.Then the paper presents the studies of typical UEBA algorithms,and gives comparative analysis of their performance.The paper also describes several commonly used public datasets,feature engineering methods,and two feature processing methods that enhance the accuracy of behavior representation.On this basis,this paper summarizes the advantages and disadvantages of typical anomaly detection algorithms,and the limitations of internal threat analysis and external intrusion detection.Finally,the future research directions in this field are discussed.