Splunk UBA implements a variety of machine learning algorithms, including but not limited to Probabilistic Suffix Trees, Markov graphs, and others. However, the specific algorithms implemented, while interesting, should not in our view be a primary aspect of an evaluation. In most cases, there are multiple different algorithms which can detect any particular anomaly. Rather than choosing the “best” academic algorithm, it’s at least as important to implement the selected algorithm properly and tune it in such a way to make it work well at enterprise scale.
For instance, just implementing an algorithm to generate a probabilistic suffix tree isn’t enough. The PST algorithm also has to be implemented in such a way that the tree being generated is regularly pruned so as to not just use up all available storage, and that pruning has to be intelligent enough to keep the important things while discarding the others.
Applying ML to security problems is definitely one of those situations where implementation matters at least as much as algorithm selection if not more.
