User and Entity Behavior Analytics (UEBA)

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Presumed high-impact, determined notSource: b) Presumed high-impact, but determined not high impact

Impact justification

The CVAS sub-system inside the VIEW system of record is not a high-impact use case because the Al's output from CVAS does not actually "serve as a principal basis for" the relevant type of agency action or decision. The collated information supports decisions about staffing priorities but is not used to make security-related or employment-related decisions. The use case also does not perform workplace monitoring or surveillance.

Start date

2023-07-08 (day precision)Source: 2023-07-08T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Administrative Functions

Operational functions

Risk scoring and triage Derived by keyword rules; see methodology

Problem the AI is intended to solve

The Continuous Vetting Analytics Service (CVAS) sub-system in the Vetting Identities for an Enterprise Workforce (VIEW) system of record will solely be used to aggregate information provided by or authorized to be collected by an DHS applicant and then presents the aggregated information in a structured manner and present it to personnel security adjudicative specialist to help them prioritize workload and improve review processes.

Expected benefits

Enhanced Threat Detection: Identify patterns in user behaviors that deviate from normal baselines, signaling potential insider threats or security risks. Continuous Risk Assessment: Move from static vetting to a continuous vetting process by monitoring real-time activities and interactions with secure information. Improved Incident Response: Enable rapid responses to high-risk behaviors, escalating alerts for timely intervention by security personnel."

System outputs

Behavioral Baseline Modeling: Develop a baseline for each individual based on regular access patterns, network usage, and interactions with classified data or secure areas. Anomaly Detection: Employ machine learning models to detect deviations from established baselines, such as unusual access times, atypical access to high-sensitivity resources, or excessive data downloads. Risk Scoring: Assign a risk score to each user based on observed anomalies, factoring in historical behavior, job role, and access level, allowing security teams to prioritize investigations. Automated Alerts & Reporting: Generate automated alerts for high-risk behaviors or patterns of concern and deliver timely reports to personnel security teams for further investigation."

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

Vetting Identities for an Enterprise Workforce

Custom-developed code

Yes

Public source code

Not reported

Sourcing

How it was built

Purchased from vendorSource: a) Purchased from a vendor

Vendor (as reported)

CANDA Solutions

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

Yes

Privacy Impact Assessment

Not reported

Authorization to Operate

Yes

Demographic features

Not reported

Training and evaluation data

Personally Identifiable Information (PII), Sensitive Sensitive Personally Identifiable Information (SPII), Clearance and Background Investigation Data: Data from security clearances, background investigations, and adjudication records.

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported