Comprehensive User and Entity Behavior Surveillance System

To address the ArmyÆs need for a novel User and Entity Behavior Analysis capability that severs as a policy decision point in the tactical zero trust architecture, Intellisense Systems, Inc. (Intellisense) proposes to develop a new Comprehensive User and Entity Behavior Surveillance (CUES) system based on an integration of matured rules-based monitors and a dynamic graph neural network (GNN) framework. Specifically, the innovation in developing dynamic GNN analysis that is interoperable with the Elastic Stack pipeline will enable CUES to identify and characterize high-level anomalous behaviors that are only observed by correlation of multiple data logging modalities. As a result, the proposed CUES system will overcome deficiencies in existing zero trust frameworks in operational complexity, user experience, granular role-based access controls, and scalability, directly addressing the Army Program Executive Office Command Control Communications-Tactical requirements. In Phase I, Intellisense will produce a proof of concept in the form of a whitepaper that demonstrates the feasibility of CUES by detailing the user and entity behavior analysis capability using data generated from synthetic monitoring of simulated user and entity activity. In Phase II, Intellisense plans to develop a flexible prototype representational state transfer application programming interface Āthat demonstrates user entity behavior analysis from data acquired from an Elastic Stack. The Phase II prototype demonstration will also show the ability to display a userÆs risk score change based on behavioral anomalies, allowing for a human in the loop to decide on access based on the alert.