Title: Evaluation criteria for network security solutions based on behaviour analytics

Authors: Manya Ali Salitin; Ali Hussein Zolait

Addresses: Department of Information Systems, College of Information Technology, University of Bahrain, P.O. Box 32038, Sakhir, Kingdom of Bahrain ' Department of Information Systems, College of Information Technology, University of Bahrain, P.O. Box 32038, Sakhir, Kingdom of Bahrain

Abstract: This research aims to develop a set of evaluation criteria to identify and select a reliable user entity behaviour analytics (UEBA) solution for enterprises. A quantitative method is used to validate a set of evaluation criteria. Data were obtained from 280 high-profile network security professionals and analysed. Researchers used confirmatory factor analysis to validate the measurement model for convergent validity and reliability of criteria constructs, including evaluating the priority of each criterion item by security professionals. Findings depict that UEBA criteria are a multidimensional construct comprising six factors: 1) general capabilities; 2) use cases; 3) log reports for analysis of user behaviour; 4) profiling models; 5) alert reports; 6) integration with other solutions. Although the study's limitations might come from the respondents if selected globally, the results might be somewhat different. The novelty of this research work lies in developing and validating an instrument, empirically tested and validated by network security professionals and used by them to choose a reliable solution for their companies and what features of network security solutions are a must as per the perception of high profile users.

Keywords: user entity behaviour analytics; UEBA; security solution; security measurement model; network security; security solutions criteria.

DOI: 10.1504/IJSCC.2023.129918

International Journal of Systems, Control and Communications, 2023 Vol.14 No.2, pp.132 - 147

Received: 24 Jan 2022
Accepted: 16 Jul 2022
Published online: 03 Apr 2023 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article