User Entity and Behavior Analytics (UEBA) for Security Operations (SecOps) Anomaly Identification

Overview

Development stage

DeployedSource: c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.

High-impact designation

Presumed high-impact, determined notSource: b) Presumed high-impact, but determined not high impact

Impact justification

This use case collates information provided by or authorized to be collected by an employee as part of network security process. The collated information supports decisions about staffing priorities but is not used to make security-related or employment-related decisions.

Start date

2024-08-17 (day precision)Source: 2024-08-17T00:00:00

Withheld from public reporting

Not reported

Mission

Topic area

Cybersecurity

Operational functions

Risk scoring and triage Derived by keyword rules; see methodology

Problem the AI is intended to solve

User Entity and Behavior Analytics (UEBA) assists USCIS Security Operations (SecOps) in identifying behavioral anomalies that most likely indicate malicious intent or heightened risk associated with user identities and endpoint hosts accessing the USCIS network. The analytics provide risk scoring, which helps USCIS SecOps to prioritize highest risk incidents first.

Expected benefits

UEBA's purpose is to review USCIS system logs to determine when an entity is performing actions that are anomalous. An entity can be classified as a workstation, server or an internal USCIS system account. The UEBA ingests logs from systems to perform analytics based off of models that are manually created and maintained. UEBA uses the models to apply a risk score to the entity which the risk score is then used to create a case (or ticket) for Security Operations analyst review. The AI reviews the action of the analyst to adjust the risk scoring for future events. Output would assist in prioritizing cyber events for further manual investigation.

System outputs

Output of the Machine Learning is an alert with all artifacts for the SOC to investigate. The alert is used as a recommendation to prioritize specific investigations in the SOC ticket queue.

Technology

AI classification

Classical / predictive MLSource: Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relatio…

System name(s)

ESS

Custom-developed code

Yes

Public source code

Not reported

Sourcing

How it was built

Contract and in-houseSource: c) Developed with both contracting and in-house resources

Vendor (as reported)

Gurucul

Vendors (standardized)

None on the standard list

A vendor is the supplier named by the agency. It does not identify the underlying model or AI technology.

Data and privacy

Involves PII

No

Privacy Impact Assessment

Not reported

Authorization to Operate

Yes

Demographic features

Not reported

Training and evaluation data

Data used to tune models is USCIS internal system logs.

Federal Data Catalog

Not reported

Governance

0 of 8 minimum-practice questions answered. A blank answer means the agency reported nothing; it does not mean the practice is absent.

Potential impacts and how they were identified

Not reported