Security Information and Event Management Using Deep Learning Project Documentation

Abstract

Organizations currently deploy various security solutions to protect their information resources. These tools like firewalls, network gateways, and other intrusion prevention tools have become obsolete as hackers can now break into firewalls, send emails with malicious and infected attachments or even bribe employees to gain access to an organization's firewalls. A new approach to cybersecurity is by using user and entity behavior analytics (UEBA). The focus of this paper is to demonstrate how UEBA and deep learning algorithms can be used to detect suspicious and anomalous behaviors within a system. Based on historically profiled user action sequences in a network, Long Short-Term Memory (LSTM) neural network will be used to predict the next state of user action and flag an action as suspicious when the action sequence deviates from the predicted sequence.