Real-Time Behavioral Anomaly Detection

Create a Kafka source in RisingWave for your user activity event stream. Define a per-user baseline materialized view using SQL window aggregations: COUNT of activity events per user over a 30-day rolling window divided by the number of days gives the daily baseline rate. Define an anomaly detection view that compares the current 1-hour rate against the daily baseline. The baseline updates incrementally with each new activity event without batch recomputation.

ML-based UEBA trains models on historical behavioral data and scores new events against the trained model, requiring periodic retraining as behavior evolves. SQL-based streaming UEBA maintains rolling statistical baselines as materialized views that automatically incorporate new behavior as events arrive. SQL baselines are interpretable: you can read the SQL to understand exactly what is being measured and why an anomaly was flagged, making tuning and false positive investigation straightforward.

Yes. New users start with no baseline, so their first events are evaluated against a peer group baseline defined by similar users (same team, same role, same application). As the user accumulates activity history, the per-user baseline gradually takes over from the peer group baseline. Define the peer group baseline as a SQL GROUP BY over a user attribute like department or role, and blend it with the per-user baseline using a SQL CASE expression weighted by history length.

Adjust the deviation ratio threshold in the SQL WHERE clause of the anomaly detection view. Start with a high threshold (for example, 5x the baseline rate) and reduce it as you validate the false positive rate. Add SQL conditions to suppress anomalies during known exceptions: scheduled batch jobs, maintenance windows, or recent role changes. All tuning is SQL edits to the detection view without retraining a model or restarting the pipeline.