BEHAVIORAL PROFILE CARDS AS A DESIGN TOOL FOR THE UEBA SYSTEM

Raevskaya Natalia Aleksandrovna, Tsaregorodtsev Anatoly Valerievich, Bulekova Ekaterina Vladimirovna, Usenko Elizaveta Alekseevna, Petrykina Anastasia Denisovna

In the context of growing cybercrimes, insider attacks pose a significant threat to corporate systems, disguised as legitimate activity. This article explores the use of behavioral profile maps as an innovative tool for designing UEBA (User and Entity Behavior Analytics) systems to detect such threats. It proposes a comprehensive methodology that includes the collection of data from access logs and operation metadata, their structuring, and visualization using machine learning algorithms (k-means, DBSCAN, LSTM, and t-SNE). Special attention was paid to the selection of relevant metrics, such as the frequency of requests to sensitive data and temporal anomalies, as well as integration with SIEM/DLP for prompt response. An experimental A/B test conducted in an IT media holding company confirmed the effectiveness of the approach: false positives were reduced by 80%, quality metrics improved (Precision 0.91, Recall 0.88, F1-Score 0.89), and the response time was reduced to 5 hours. The consideration of ethical and legal aspects, including compliance with Federal Law №152, ensured a balance between security and employees' rights. Recommendations for transparent monitoring, data anonymization, and automation of analysis were developed. The practical significance of the work lies in the creation of interpretable dashboards and templates for integration with corporate systems. Further research prospects include the use of large language models for text log analysis, the automation of ethical audits through smart contracts, and the development of monitoring standards for non-standard roles. The proposed approach forms the basis for responsible application of behavioral analytics, combining technical efficiency with ethical standards and minimizing the risks of data leaks.

Keywords:insider threats, cybersecurity, machine learning, behavioral profile.