Cyber criminality activities are changing and becoming more and more
professional. With the growth of financial flows through the Internet and the
Information System (IS), new kinds of thread arise involving complex scenarios
spread within multiple IS components. The IS information modeling and
Behavioral Analysis are becoming new solutions to normalize the IS information
and counter these new threads. This paper presents a framework which details
the principal and necessary steps for monitoring an IS. We present the
architecture of the framework, i.e. an ontology of activities carried out
within an IS to model security information and User Behavioral analysis. The
results of the performed experiments on real data show that the modeling is
effective to reduce the amount of events by 91%. The User Behavioral Analysis
on uniform modeled data is also effective, detecting more than 80% of
legitimate actions of attack scenarios.