Which of the following event detection techniques uses User and Entity Behavior Analytics (UEBA)?

User and Entity Behavior Analytics (UEBA) is an advanced security technique that focuses on monitoring the behavior of users and entities (hosts, applications, etc.) within a network. It establishes a baseline of normal activity using machine learning and statistical analysis. When an activity deviates significantly from this established baseline, it is flagged as a potential threat. This method of detecting threats by identifying deviations from a norm is the core principle of anomaly-based detection.

A. Rule-based detection relies on predefined static rules to identify specific, known malicious activities, not behavioral baselines.
B. Heuristic-based detection uses experience-based rules or algorithms to identify potential threats, which is less dynamic than UEBA's machine learning-based baselining.
D. Signature-based detection identifies threats by matching patterns or "signatures" of known malware or attacks, which is ineffective against new or unknown threats.

1. Ricci, F., Rokach, L., & Shapira, B. (Eds.). (2022). Recommender Systems Handbook (3rd ed.). Springer. p. 735. "UEBA systems are based on anomaly detection methods that build profiles of normal behavior for users and entities."

2. National Institute of Standards and Technology (NIST). (2013). Guide to Intrusion Detection and Prevention Systems (IDPS) (NIST Special Publication 800-94). Section 2.2.2. While not using the term UEBA, it describes anomaly-based detection as collecting data on normal behavior and flagging deviations, which is the foundation of UEBA.

3. D'hooge, L., Wauters, T., Volckaert, B., & De Turck, F. (2020). Anomaly-based Intrusion Detection in ICT Systems. In Guide to Vulnerability Analysis for Computer Networks and Systems (pp. 229-253). Springer. https://doi.org/10.1007/978-3-030-34535-29 (This chapter details the principles of anomaly-based detection, which directly align with UEBA's methodology).