DEEP LEARNING MODEL FOR PREDICTING COMPROMISED ACCOUNTS IN SECURITY EVENT MANAGEMENT SYSTEMS

Abstract

In modern corporate information systems, the frequency of complex attacks aimed at compromising user accounts is increasing. Traditional security event management systems, based on correlation rules and signature analysis, demonstrate limited ability to predict potential incidents, as they do not account for temporal dependencies and user behavioral patterns. In this regard, the application of deep learning models capable of reproducing nonlinear relationships between authentication parameters and the probability of account compromise becomes relevant. This paper proposes a Deep Learning model for predicting compromise risk, built on a recurrent neural network of the LSTM type with an attention mechanism, which allows dynamic determination of the weight of temporal features in sequences of authentication events. The problem formalization involves minimizing a loss function that reflects the difference between the predicted probability of compromise and the actual state of the account. This approach increases the accuracy of anomaly detection and contributes to the construction of adaptive behavioral analytics within SIEM/UEBA architectures. The model implements the compromise risk prediction function as a task of minimizing a regularized loss function, which reflects the deviation between the predicted threat probability and the actual security state of the account. Optimization is performed using the Adam algorithm, which ensures stable convergence and the ability to generalize across heterogeneous datasets. The integration of the model into a SIEM environment creates a basis for context-oriented risk analysis, which aligns with the principles of Zero Trust Architecture (NIST SP 800-207, 2020; MITRE ATT&CK, v14, 2024) and the recommendations of the ENISA Threat Intelligence Framework (2023) for proactive real-time incident detection.