E-GUARDS: Enhanced UEBA with Graph based Unsupervised Anomaly Detection and Semi-Supervised Risk Scoring

Zero trust (ZT) is an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources. An effective zero trust architecture (ZTA) needs maximum visibility into all users and non-person entities to ensure continuous authentication. Current solutions cannot meet this need due to their design for the static use case, and/or the substantial manual effort required for the tuning of the parameters. The application of Machine Learning (ML) in User and Entity Behavior Analysis (UEBA) is promising but faces obstacles such as lack of training data, complexity, high cost, high level of false positives, and lack of a systematic risk scoring approach for both users and non-person entities. To address this technical gap, PJR proposes to develop E-GUARDS, a novel UEBA solution that can perform advanced analytics over activity data on users and non-person entities to streamline authentication to access the network and services, through multi-source graph-based unsupervised anomaly detection, and semi-supervised risk scoring. The proposed solution, if developed successfully, will be a critical enabler to the ArmyÆs ZTA implementation, and substantially improve the tactical networkÆs cybersecurity posture.Ā