User and Event Behavior Analytics on Differentially Private Data for Anomaly Detection

Abstract

In today's world of digitization, anomaly detection has become one of the most important issues in our lives. User and Entity Behavior Analytics (UEBA) is a security solution for anomaly detection. UEBA minimizes the impact of attacks on data and decreases the risk of privacy breeches by keeping track of normal user and entity behaviors. Organizations need to deploy security control through UEBA in order to achieve security for their data by detecting attacks in their early stages, but the cost of such security control is often out of reach for many small and medium enterprises. One possible solution for such organizations is to outsource UEBA to third parties. However, such an approach can result in disclosure of private data. In this paper, we propose a novel scheme that integrates differential privacy into UEBA. We will show that by introducing noise to the data before publishing it to the third party for anomaly detection, we can ensure that the privacy of the data remains intact, while allowing the third party to preform accurate UEBA analysis. Our experimental results and security analysis will show the validity of our approach.