Behavioral Analytics

Deviation in Count

Detect the unusual peak and trough of any activity in your environment with a deviation in count. For example, sign failure rates are abnormally higher than usual, accessing an unusual number of resources in an environment, or an unusual number of files modified by a user.

For each combination of rows from the selected UDM fields, the model generates a baseline behavior.

Use case: Abnormal spike in login fail attempts

The attacker tries to login to systems by brute force attacks or credential stuffing to steal confidential details or distribute malware across other systems within the organization.

For example, Emily, a system administrator, typically experiences a low number of login failure attempts due to her familiarity with the login process. However, the deviation in the count model flags a sudden increase in failed login attempts for Emily's account over a short period of time. Investigation reveals multiple failed login attempts from different IP addresses at remote locations during non-business hours, indicating a potential brute-force or credential stuffing attack targeting Emily's account.

Employing the Deviation in Count model helps in detecting the increased spikes in login failures by establishing a baseline during the model configuration.

Deviation in Volume

Deviation in volume spots any anomalous transactional volume in your environment. For example, a sudden spike in data uploaded from a host. This model requires a numeric field to establish a baseline and a string field to create attribution.

You can choose if the model should be baselined on maximum, minimum, average, or sum of the transactional activity performed over the defined aggregation window -- daily, weekly, and hourly.

The enumeration model tracks – enumeration attacks – attempt to discover information about a system or network. The resultant information is used to detect future attacks, such as brute-force attacks or password dictionary attacks. For example, if an attacker scans a large number of ports on a system, it could be a sign of a brute-force attack.

The enumeration model has been segregated into two types:

• Rarity: In this analysis type, the model detects a rare behavior by baselining with the usual behavior of source and target ports. The usual behaviors for source and target aggregate on a daily basis.
• Deviation: In this analysis type, the model detects an anomaly when a source connects to unusual number of targets by baselining with the defined count of targets. The count of targets aggregates on daily basis.

Note: You can use any one or both analysis types at a time while configuring the enumeration model.

Enumeration attacks are carried out via multiple methods, which include:

• Port scanning: This involves scanning a system or network for open ports. Open ports can then be targeted for further attacks.
  

  Use case: The following example illustrates how an attacker gains access to the internal systems via vulnerable ports.

  Alex, a network administrator, typically conducts routine network scans to identify vulnerabilities and ensure network security. The enumeration model has been implemented in his organization, and it flags a spike in the port scans in Alex's account. Upon investigation, Alex identified some ports that were vulnerable and gained access to his account to map out his organizational infrastructure. The enumeration type model detects this abnormal behavior and triggers an alert, enabling the security team to promptly respond and mitigate the potential security breach.
• Ping scanning: This involves sending ping requests to a system or network to see if it is responding. This can be used to identify active hosts.
• DNS enumeration: This involves querying DNS servers for information about a domain name. This information can be used to identify subdomains, email servers, and other hosts associated with the domain name.
  Use case: The following example describes how an internal system is compromised by DNS brute force attacks.
  Sarah, a ligitimate employee in an organization, commonly accesses confidential information by querying the DNS subdomain during her working hours. The enumeration model learns this common behavior and records it as a pattern. At an unusual time, the enumeration model detects enormous DNS queries originating from internal IP addresses that do not match any user profile. These queries include “Admin”, “hr”, and “finance” keywords in the subdomains to get access to sensitive areas in a network. Resolution Intelligence Cloud receives a signal, turns it into an actionable item, and triggers an alert to respective personnel to mitigate the issue.

Other examples include:

1. One s3 bucket accessed by many unique accounts.
2. One machine having multiple unique login failures.
3. One Source IP, one destination ip accessing(targeting) many distinct ports.
4. One account, one port accessing (targeting) many distinct destination addresses.

Rare occurrence of an event

Rare occurrences learn past behaviors for the combination of UDM fields selected to discern a rare behavior from a repeated behavior. Repeating an activity that is currently considered rare will eventually cause the model to learn and no longer distinguish it as rare.