Facade detects suspicious activity by learning how users, resources and actions relate to one another. Instead of looking at an event in isolation, the system considers its surrounding context across document access, database queries and HTTP/RPC requests.
The model learns from benign activity using contrastive learning, addressing the scarcity of labeled insider incidents. The paper describes the system deployed at Google since 2018 and reports false positive rates low enough for practical investigation.
The earlier Black Hat presentation introduces the system and its open-source implementation.
