D1T2 - Applying Machine Learning to User Behavior Anomaly Analysis
summary
R&D for a user-behavior analytics prototype uses clustering for feature selection, serial-correlation checks for data quality, frequency-tuned scoring and behavioral whitelisting with prefix coding, and LSTM recurrent nets to predict next actions; applied to messy SAP audit logs (≈550 formats, ~500k possible program names mapped into groups). Adaptive thresholds learned from training and synthetic datasets augment scarce labels. Resulting classifier hits ~95% overall accuracy, detecting ~71% of labelled security anomalies while marking 97% of safe events (≈3% false positives); prototype is experimental, not yet production-scaled.
AI-written summary · about
chapters (11)
- 0:00Introduction to research
- 2:02Traditional ERP security gaps
- 7:25User behavior analysis basics
- 13:15Machine learning security workflow
- 18:44Data normalization challenges
- 22:20Threat modeling for UBA
- 26:42Static anomaly detection
- 33:16Temporal anomaly detection
- 41:31Model training and tuning
- 58:04Key takeaways and conclusion
- 59:30Q&A session
related talks
19mThe Rise of AI in Anomaly Detection
16mAI-Driven Behavioral Analytics for Real-Time Fraud Prevention
13mBehavioral Analytics for Real-Time Fraud Prevention
52mDevil in the Haystack
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
34mData Mining for Security Anomalies
41mUsing Machine Learning to Help with Daily Workflows
39mDetecting Website Intrusion and Account Compromise with Machine Learning