Definition #
ML models establishing behavioral baselines and flagging suspicious activities.
Key Characteristics #
- Keystroke dynamics
- Network traffic analysis
- Session clustering
- Adaptive thresholds
Why It Matters #
Detects 92% of insider threats missed by rule-based systems (Gartner).
Common Use Cases #
- Account compromise detection
- Rogue trader identification
- Data exfiltration prevention
Examples #
- Exabeam
- Varonis
- Darktrace
FAQs #
Q: False positives?
A: Maintains <0.1% FPR through ensemble learning.
Q: Privacy compliance?
A: Uses pseudonymized data with GDPR-safe retention.