Enhancing Insider Threat Detection with Adaptive Thresholds – A Closer Look at Fortscale’s SMART Values

Detecting and preventing insider threats is a crucial aspect of cybersecurity for any organization. With the rise of data breaches and cyber attacks, it has become more important than ever to have a reliable system in place that can identify and mitigate potential risks from within the organization.

At Fortscale, our product is designed to help organizations eliminate insider threats by detecting anomalous user behavior. But how do we do it? The key lies in our advanced machine learning algorithms that continuously analyze user activity and generate risk scores based on various behavioral aspects.

Each user has multiple models dedicated to capturing different aspects of their behavior, such as working hours, login locations, and connection patterns. When a user engages in an anomalous activity, these models trigger high risk scores, which are then used to create alerts for suspicious behavior.

However, determining the threshold for what constitutes a high enough risk score to trigger an alert is not a simple task. Setting the threshold too low results in numerous false positives, while setting it too high may cause genuine threats to go unnoticed. This dilemma is known as the ROC curve, and it highlights the challenge of finding the right balance between sensitivity and specificity.

To address this issue, we have implemented a second layer of learning that automatically adjusts the threshold for each user based on their past behavior. By analyzing a user’s historical SMART values (Significant Multiple Anomalies useR Threats), we can dynamically adapt the threshold to ensure that only truly anomalous activities trigger alerts.

For users who exhibit a wide range of behaviors, their threshold curve will be broader, allowing for more flexibility in triggering alerts. On the other hand, users with more consistent behavior patterns will have narrower threshold curves, ensuring that only major deviations from their norm are flagged.

Furthermore, we also take into account the organization’s overall level of anomalous activity when determining thresholds. By analyzing the organization’s past SMART values, we can adjust individual thresholds to align with the current risk landscape and ensure that resources are focused on the most critical threats.

In future posts, we will delve deeper into the technical details of how these adaptive thresholds are implemented, including how user and organization curves are fitted to their respective SMART values and how they are combined to optimize threat detection efficiency.

By leveraging advanced machine learning techniques and adaptive thresholding, Fortscale’s product offers organizations a proactive approach to insider threat detection, helping to safeguard sensitive data and maintain a secure environment for their operations. Stay tuned for more insights into our innovative approach to combating insider threats.