Anomaly Detection
Based on usual activity we can find out anomalies...
Something that does not belong
There is suspicion about something
Attempt to mirror legitimacy
Unexpected randomness or patterns
Unexpected frequency of occurrences
Normal things in an abnormal context
Types
Mirroring Legitimacy
Attempting to hide by mimicking characteristics of legitimate entity.
Examples:
process
file name
e-mail
domain
username
Frequency of occurrences
Events that occur fewer or greater than the average/expected number of times. Requires knowledge of standard behavior/sequence and thresholds.
Examples:
Authentication
Process Execution
Generic non-descriptives
Attempt to hide by prsenting broad or generic information. Many legitimate entities use generic names.
Examples:
process
file name
e-mail
domain
Missing information
Evidence that is missing expected data or context.
Examples:
process id
malicious documents
missing logs (all), kind of red flag
Content Formatting
Anomalies in the way data is converted or represented that manifest in evidence. May often manifest in translation from other languages and character sets.
Examples:
typosquatting - domain name, looks like e but it is not e in latin - its cyrilic (different ASCII character)
Unexpected obfiscation and encryption
The unexpected use or absence of obfiscation or encryption. This anomaly type centers or actual vs. expected entropy.
Examples:
e-mails
scripts
HTTP
protocol Payloads
Unexpected 1:M relationship
Events from one source to many destinations, or vice versa, when that it is not expected in the given context.
Examples:
Authentication (enumeration)
Network connections
Improper Timing
Events occuring outside of a normal or expected date/time. Do not forget on time-zones, working hours, people on business trips,...
Examples:
authentication
logs
web browsing
downloads
process execution
Unexpected Entity Relationships
Interaction between two entities that are anomalous based on the properties and expected behavior of the entity.
Examples:
User to host authentication
User to host network communication
Uset to process ownership
In general
Baseline deviations
A behaviour occurs the same way for a long time and then changes
Normal things in abnormal context
The usage of legitimate application in a way that is not typical for it
General Unknowns
Things you do not understand amongst things you do understand
Last updated