The role of User Entity Behavior Analytics to detect network attacks in real time

Organizations are using advanced security solutions to protect their information resources. However, even such high investments, traditional security approaches failed to protect the network structure against state-of-the-art attacks. New proactive approaches to security are on the rise such as User Entity Behavior Analytics (UEBA). UEBA is a type of cybersecurity process that uses machine learning, algorithms, and statistical analyses to detect real-time network attacks. This paper aims to assess the value and success of using behavior analytics in securing the network from not-before-seen attacks such as zero-day attacks. This paper uses a systematic literature review and self-administrated survey and interviews with convenience sampling of high profile network users and top security vendors. Survey and interviews with various security experts are utilized to verify the matter-of-fact effectiveness of the solutions based on behavior analytics. During collecting the primary data via a survey, researchers will go for a structured interview with vendors who are selling solutions to understand the performance of behavior analytics-based solutions and the distinct features of their solutions. The results of literature review, survey, interviews and focus groups will be used to assess the value and success of using behavior analytics in securing the network from not-before-seen attacks such as zero-day attacks. The endeavor of this paper is to highlight the weaknesses and strengths of different UEBA solutions and their effectiveness for detecting network attacks in real-time interaction. This research contrasts top fifteen UEBA technologies based on use cases and capabilities and highlights common usage scenarios. Based on the evidence, recommendations will be given.