Endpoint threat analytic: A people-oriented cybersecurity

面对不断升级的全球网络安全威胁，拥有一个自动预警系统至关重要，它可以发现可疑的用户活动，并作为计划攻击或最终安全漏洞的预防技术。人们普遍认为，通过收集大量数据，从端点提取可计算的特征，并进行分析、比较和数据挖掘，我们可以检测到感染了恶意软件的机器，而目前最先进的安全系统无法检测到这些机器。同样的数据可以用来发现流氓员工使用的窃听软件，或者事件数据盗窃。在这个项目中，将使用标准端点检测和IBM的QRadar作为代理，从大量来源收集数据，并构建用户的通用安全配置文件和分析，以支持检测恶意软件或流氓员工。该系统将利用图形数据库并使用图形可视化技术为最终用户提供支持系统分析的证据。拟议的以人为中心的网络安全框架将集成到IBM QRadar技术中，并将大大提高其评估和管理内部和外部风险的能力，并在恶意威胁和潜在的网络犯罪活动造成伤害之前检测到它们

In the face of escalating global Cybersecurity threats, it is paramount to have an automated forewarning system that can find suspicious user activities and work as a prevention technique for planned attacks or ultimate security breaches. There is a widespread belief that by collecting large amounts of data, extracting computable features from endpoints, and doing analysis, comparisons, and data mining, we can detect machines infected with malware that are currently undetectable by state of the art security systems. This same data could be used to find eavesdropping software used by a rogue employee, or event data theft. In this project, a standard Endpoint Detection and IBM's QRadar will be used as an agent to collect data from a large number of sources and build users' universal security profiles and analytics to support the detection of malware or rogue employees. The system will leverage graph databases and uses graph visualization techniques to provide the end user evidence supporting the system's analysis. The proposed people-centric cybersecurity framework will be integrated in the IBM QRadar technology and will substantially increase its ability to assess and manage internal and external risks, and detect malicious threats and potential cybercriminal activities before they cause harm