User and entity behavioral analysis using an advanced cyber decision platform

A system for user and entity behavioral analysis using an advanced cyber decision platform, comprising:

• a computing device comprising a memory and a processor;
• a grouping engine comprising a first plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the first plurality of programming instructions, when operating on the processor, cause the computing device to:
• create an interaction dataset based at least in part on interactions of users and devices within a network;
• process the interaction dataset with at least graph analysis to generate an interaction map;
• store the interaction dataset and interaction map;
• and
• create a plurality of groups from the users and devices within the network based at least in part on the interaction map;
• a behavioral analysis engine comprising a second plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the second plurality of programming instructions, when operating on the processor, cause the computing device to:
• create a network-usage dataset based at least in part on access logs of the users and devices within the network;
• process the network-usage dataset to generate a behavioral baseline for each of the previously created groups;
• and
• store the network-usage dataset and behavioral baseline;
• and
• a monitoring service comprising a third plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the third plurality of programming instructions, when operating on the processor, cause the computing device to:
• continuously monitor each group for anomalous network behavior based at least on the behavioral baseline;
• periodically create and store a behavioral analysis snapshot of the users and devices within the network;
• receive an identified vulnerability and an identified extent to which the network may be compromised from a simulation engine;
• improve the security of the network by changing an access privilege of one or more of the users and devices on the network based on the identified vulnerability and identified extent;
• and
• a simulation engine comprising a fourth plurality of programming instructions stored in the memory of, and operating on the processor of, the computing device, wherein the fourth plurality of programming instructions, when operating on the processor, cause the computing device to:
• retrieve the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot from storage;
• run a simulation comprising a simulated cyber-attack of a particular type on the network using the interaction dataset, interaction map, the network-usage dataset, behavioral baseline, and behavioral analysis snapshot;
• identify a vulnerability of the network to the simulated cyber-attack of a particular type;
• identify an extent to which the network may be compromised based on the simulated cyber-attack of a particular type;
• send the identified vulnerability and identified extent to the monitoring service.