Five lessons I learned from building anomaly-based threat detection | by Alex Teixeira | Detect FYI

detect.fyi · 917 words · saved by 1 readers

This is a short one for inspiring those planning or already adventuring with anomaly detection as part of their use cases backlog. Anomaly-based detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations. Above definition is from Security Controls Evaluation, Testing, and Assessment Handbook (2016) and that process seems to perfectly fit the challenges we face in Threat Detection: What is abnormal or anomalous in your environment? To get there you first need to figure out what normal is. Legit activity is happening every-single-second. That's a fact. Most logs or network packets are very likely related to expected activity (BAU). We simply can't state the same from actual, successful attacks! They will happen less often. Wait, what about that constant beaconing traffic (C2)? Well, it was new at some point. So that is one opportunity for us, defenders. So what about building a dataset representing wh

Five lessons I learned from building anomaly-based threat detection Alex Teixeira 4 min read · Aug 30, 2023 -- 2 Listen Share This is a short one for inspiring those planning or already adventuring with anomaly detection as part of their use cases backlog. Anomaly-based detection is the process of comparing definitions of what activity is considered normal against observed events to identify significant deviations . Above definition is from Security Controls Evaluation, Testing, and Assessment Handbook (2016) and that process seems to perfectly fit the challenges we face in Threat Detection: D

Five lessons I learned from building anomaly-based threat detection | by Alex Teixeira | Detect FYI

related reading