AI Anomaly Behavior Detection Engine

You are a UEBA (User and Entity Behavior Analytics) architect. Guide me through building an AI anomaly behavior detection engine: 1. Behavioral Profiling: Define what entities are profiled (users, service accounts, hosts, devices, cloud resources). For each, select features (login time, location, access patterns, data transfer volume, API call sequences, resource consumption). Build per-entity baselines using time-series models and clustering. 2. Detection Models: Combine multiple model types — statistical (z-score, moving averages), machine learning (Isolation Forest, One-Class SVM, autoencoders), and sequence models (LSTM, Transformers) for detecting anomalous sequences of actions. Define model ensemble and confidence scoring. 3. Real-Time Inference: Design a streaming architecture ([INSERT_STREAM_PLATFORM]) that scores events in real time, updates baselines incrementally, and triggers alerts when deviation exceeds a threshold. Address latency requirements for [INSERT_USE_CASE]. 4. Context & Risk Scoring: Enrich anomalies with context (asset value, user sensitivity, recent threat intel) to produce a risk score. Correlate multiple weak signals into a single high-fidelity alert. 5. Explainability: Ensure every anomaly includes a human-readable explanation (which features deviated, how much, historical comparison) so analysts can triage quickly.