Detection of Unauthorized Use in SIEM Through Behavioral Analysis and Adaptive Rules

Higher education institutions in Ecuador face a growing exposure to unauthorized access and data exfiltration, compounded by fragmented log infrastructures that obstruct real-time threat visibility. This study addresses those gaps through the design and deployment of a Security Information and Event Management (SIEM) architecture at the Compu Sur Higher Technological Institute (ITECSUR), augmented with User and Entity Behavior Analytics (UEBA) and a context-sensitive adaptive rule engine. Rather than relying on static signature matching, the proposed model constructs individual behavioral baselines per user and asset, dynamically escalating alert thresholds according to geographic context, access time, and asset sensitivity classification. Empirical validation conducted over 450 security events, including simulated Salgorea Trojan injections, supply chain compromise scenarios, and government-grade spyware indicators, yielded a Mean Time to Detect (MTTD) reduction from 48.5 hours to 12.4 minutes (99.57%), a recall rate of 95%, and a 65% decrease in false positives relative to rule-only baselines. Hardening protocols applied in parallel reduced exposed network ports by 78% and elevated institutional compliance with Ecuador's Organic Law on Personal Data Protection (LOPDP) from 35% to 92%. The architecture, built on AlienVault OTX and Osquery agents, processed over 1.2 million daily Indicators of Compromise autonomously, demonstrating operational feasibility for institutions with constrained IT budgets. These findings position SIEM-UEBA integration as both a technical countermeasure and a regulatory compliance instrument for the higher education sector.