Heuristic Behavior Analytics
Description
Identify anomalous behaviors from established baselines for VA Accounts and Hosts. The output is a Risk score that is provided to CSOC Analysts to more quickly identify accounts and hosts that have been compromised after the initial authentications associated with a computational session
Detailed example
Risk scores for Accounts and Hosts, based on a comparison of recent and historic activities.
AI / analytics pattern
Classical/Predictive Machine Learning: Models trained on data to make predictions or classifications based on identified patterns or relationships.
Automation level / stage
c) Deployed – The use case is being actively authorized or utilized to support the functions or mission of an agency.
Expected benefit
Quicker identification, response, and mitigation of cybersecurity incidents.
Controls / human review
ATO: Not reported; PIA: Not published