UEBA Behavioral Baseline: Peer-Group Anomaly Scoring

Simulation Controls

Time speed 1.0×

Anomaly threshold (z) 3.0

Peer-group cohesion 1.0×

Detection Readouts

Active alerts

Peak risk z

0.00

Mean risk z

0.00

Engineering Finance Sales IT Admin Flagged (z ≥ threshold)

Alert Feed

Monitoring baseline…

How it works

Each employee is a point in a 3-axis behavioral feature space: after-hours access frequency, data-egress volume, and distinct systems touched per day. Every peer group (department) has learned a baseline — a mean vector μ and per-axis standard deviation σ — shown as a translucent ellipsoid.

UEBA platforms score deviation from that baseline with a Mahalanobis-style distance. Assuming per-axis independence, this reduces to a standardized Euclidean norm:

z_i = sqrt( Σ_k ((x_i,k − μ_group,k) / σ_group,k)² )

The raw z is smoothed with an exponential moving average (time-constant ~1.2s) to suppress single-tick noise, exactly as a real detector debounces flapping signals:

risk(t) = risk(t−dt) + (z(t) − risk(t−dt)) · (1 − e^(−dt/τ))

Time speed — scales how fast the underlying telemetry random-walks.
Anomaly threshold — the z-score above which an entity is flagged red and logged to the alert feed.
Peer-group cohesion — scales σ for every group; a tighter baseline (higher cohesion) makes the same deviation score as more anomalous, mirroring how a well-modeled peer group increases detection sensitivity.
Inject Insider Drift — pushes one random employee's true telemetry sharply outside their peer baseline (a mass data pull plus off-hours logins), the way a real insider-threat or compromised-account event would, so you can watch the risk score climb and cross the alert threshold in real time.

Real UEBA platforms (Splunk UBA, Exabeam, Microsoft Sentinel UEBA) run this same baseline-and-deviation logic across dozens of behavioral signals per identity, feeding the aggregated risk score into SOC alerting and automated response.

Axes: after-hours · egress · systems Drag to orbit · scroll to zoom

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.