SPOT: A data-driven threat detection framework with knowledge-enhanced scoring

Abstract

In an era when digital threats are becoming increasingly sophisticated and pervasive, the need for robust cyber security measures has never been more critical. Traditional methods based on fact or correlation rule matching are insufficient. Machine learning (ML) for dynamic behaviour modelling and automated scoring is now crucial for effective threat detection. This paper introduces SPOT, a practical threat detection and scoring framework and system for user and entity behaviour analytics (UEBA). The framework comprises layered modules: data-driven ML for event scoring; event organisation into meaningful threats; and threat re-prioritisation based on business knowledge factors. The system architecture supporting this framework leverages a stream-based distributed computing platform enabling Cloudscale processing for high-fidelity threat identification. This article is also included in The Business & Management Collection which can be accessed at https://hstalks.com/business/.