Endpoint threat analytic: A people-oriented cybersecurity

点击翻译按钮获取中文摘要

In the face of escalating global Cybersecurity threats, it is paramount to have an automated forewarning system that can find suspicious user activities and work as a prevention technique for planned attacks or ultimate security breaches. There is a widespread belief that by collecting large amounts of data, extracting computable features from endpoints, and doing analysis, comparisons, and data mining, we can detect machines infected with malware that are currently undetectable by state of the art security systems. This same data could be used to find eavesdropping software used by a rogue employee, or event data theft. In this project, a standard Endpoint Detection and IBM's QRadar will be used as an agent to collect data from a large number of sources and build users' universal security profiles and analytics to support the detection of malware or rogue employees. The system will leverage graph databases and uses graph visualization techniques to provide the end user evidence supporting the system's analysis. The proposed people-centric cybersecurity framework will be integrated in the IBM QRadar technology and will substantially increase its ability to assess and manage internal and external risks, and detect malicious threats and potential cybercriminal activities before they cause harm