Endpoint threat analytic: A people-oriented cybersecurity

面对不断升级的全球网络安全威胁，至关重要的是拥有一个自动预警系统，该系统可以发现可疑的用户活动，并作为预防计划攻击或最终安全漏洞的技术。人们普遍认为，通过收集大量数据，从终端提取可计算的特征，并进行分析、比较和数据挖掘，我们可以检测到感染了恶意软件的计算机，而目前最先进的安全系统无法检测到这些恶意软件。这些相同的数据可以用来查找流氓员工使用的窃听软件或事件数据窃取。在该项目中，将使用标准的Endpoint Detect和IBM的Q雷达作为代理，从大量来源收集数据，并构建用户的通用安全配置文件和分析，以支持检测恶意软件或流氓员工。该系统将利用图形数据库，并使用图形可视化技术，为终端用户提供支持系统分析的证据。拟议的以人为本的网络安全框架将被整合到IBM Q雷达技术中，并将大大提高其评估和管理内部和外部风险的能力，并在恶意威胁和潜在的网络犯罪活动造成伤害之前将其检测出来。

In the face of escalating global Cybersecurity threats, it is paramount to have an automated forewarning system that can find suspicious user activities and work as a prevention technique for planned attacks or ultimate security breaches. There is a widespread belief that by collecting large amounts of data, extracting computable features from endpoints, and doing analysis, comparisons, and data mining, we can detect machines infected with malware that are currently undetectable by state of the art security systems. This same data could be used to find eavesdropping software used by a rogue employee, or event data theft. In this project, a standard Endpoint Detection and IBM's QRadar will be used as an agent to collect data from a large number of sources and build users' universal security profiles and analytics to support the detection of malware or rogue employees. The system will leverage graph databases and uses graph visualization techniques to provide the end user evidence supporting the system's analysis. The proposed people-centric cybersecurity framework will be integrated in the IBM QRadar technology and will substantially increase its ability to assess and manage internal and external risks, and detect malicious threats and potential cybercriminal activities before they cause harm