Profiling the Invisible Insider: A UEBA-Based Machine Learning Framework for Low-and-Slow Data Exfiltration Detection
A UEBA-based machine learning framework that constructs per-user behavioral profiles from enterprise proxy and access log data, scoring sessions against a 30-feature behavioral representation spanning temporal patterns, data-transfer anomalies, domain interactions, HTTP characteristics, and session-device signals is presented.