Instructor: Analysis and detection. 2 2
So now that we've covered the overview 3 3
and we've looked at the dashboard, 4 4
which brings up those metrics, 5 5
how do we do our analysis and our detection? 6 6
When we talk about our SIEM, 7 7
there is lots of different data 8 8
that's being put into the SIEM, 9 9
and the SIEM has to apply different rules 10 10
to all those different inputs and outputs 11 11
to match and create alerts for us. 12 12
Those alerts are going to allow the analysts 13 13
to start investigating it. 14 14
Well, an analyst needs to go 15 15
through all of these different alerts, 16 16
and they need to dismiss the false positives 17 17
while they are responding to those true positives. 18 18
Essentially, we're going to have a lot of things 19 19
that are positive, 20 20
and that's what we're going to be looking at. 21 21
And then we're going to sort them out into false positive, 22 22
meaning it wasn't really a bad thing 23 23
or true positive, meaning it was a bad thing, 24 24
and now we're going to go respond to it. 25 25
Now, there's lots of different ways to do this, 26 26
and we're going to look at this 27 27
under a couple of different ways that we do our analysis. 28 28
We can have conditional analysis, heuristic analysis, 29 29
behavioral analysis, or anomaly analysis. 30 30
Let's go through each of these in this lesson. 31 31
First, conditional analysis. 32 32
Now, conditional analysis is a simple form of correlation 33 33
that's performed by a machine 34 34
using signature detection and rules-based policies. 35 35
Now, the great thing about using something like this 36 36
is that it is very clear cut. 37 37
When you have an alert pop up on your screen as an analyst, 38 38
usually it's because there 39 39
is some kind of a signature or rule. 40 40
That conditional analysis is going to use a signature or rule 41 41
to generate that alert, 42 42
and usually, it's going to be in the form 43 43
of if this aler, or if this and this or this alert. 44 44
So if I have something like if X and Y or Z, 45 45
this is going to say either Y or Z happens, 46 46
and X also happened, 47 47
then we're going to create an alert. 48 48
Now, there is a problem using this approach 49 49
of using signature-based or rules-based policies. 50 50
This is because all 51 51
of these things have to have a rule created, 52 52
and if you don't have a rule created, you're going to be blind 53 53
to any kind of zero day or previously unknown TTPs. 54 54
Also, this type 55 55
of conditional analysis creates a large number 56 56
of false positives because these rules are very basic, 57 57
and they don't understand the intricacies of human behavior, 58 58
and so often these rules can alert 59 59
even though there's nothing bad going on. 60 60
So this brings us to our second category, 61 61
which is known as heuristic analysis. 62 62
A heuristic analysis is a method 63 63
that uses feature comparisons and likenesses 64 64
rather than specific signature matching to identify 65 65
whether the target of observation is really malicious. 66 66
For example, if I said, if you see a man 67 67
and he has brown or white hair, he might be malicious. 68 68
That's a pretty generic rule. 69 69
That would be a signature-based 70 70
or conditional analysis type rule. 71 71
And you're going to have a ton of false positives 72 72
because I'm looking for one bad guy 73 73
who might have robbed a store, 74 74
but now I'm looking for everybody 75 75
who is a man and has brown or white hair. 76 76
Well, I can also go into heuristics 77 77
and I can start adding some things that look like that, 78 78
but not exactly that. 79 79
So now I'm looking for a man who has brown hair, 80 80
or maybe something between brown and white, 81 81
because it wasn't either brown or white, 82 82
it was somewhere in between. 83 83
And so as we get this kind of heuristics, 84 84
we can start seeing things that look like it 85 85
but aren't exact. 86 86
Now, when you're using heuristical analysis like this, 87 87
this is going to end up using machine learning 88 88
to help you alert on behavior that's similar enough 89 89
to a signature or rule, but it isn't necessarily exact. 90 90
Now, the benefit 91 91
of this is bad guys are really, really smart. 92 92
And so if they start realizing 93 93
that if they do this exact pattern, 94 94
it's going to flag a sensor based on a signature, 95 95
they're going to modify that pattern 96 96
just a little bit to make it harder to find them. 97 97
Well, heuristic signatures can find those things 98 98
by using this machine learning. 99 99
By using machine learning, 100 100
we're using a component 101 101
of AI that enables machines to develop strategies 102 102
for solving a task given a labeled dataset 103 103
where features have been manually identified, 104 104
but without further explicit instructions. 105 105
Now, the reason we use machine learning 106 106
is because there is just so much data out there, 107 107
and we don't have enough analysts 108 108
to go through every single alert 109 109
and try to make all these determinations for us. 110 110
So by combining machine learning 111 111
with the heuristic analysis, we can start going through 112 112
and having the machines learn over time 113 113
what exactly is bad and what exactly is good, 114 114
and they can do a better job of that than humans can 115 115
because they can process so much more information faster. 116 116
Now, this will end up having a lot of false positives. 117 117
This can have a lot of false negatives as well, 118 118
but over time, your heuristics get much, 119 119
much better when they have a good trained data set, 120 120
and they can learn over time and do a better job for you, 121 121
and this helps our analysts relieve a lot of that workload. 122 122
Now, the third type we have is what's known 123 123
as behavioral analysis. 124 124
When we deal with behavioral analysis 125 125
we have a network monitoring system that detects changes 126 126
in normal operating data sequences 127 127
and identifies abnormal sequences. 128 128
So what we're really looking 129 129
for with behavioral analysis is to generate an alert 130 130
whenever anything deviates outside 131 131
of a defined level of tolerance from a given baseline. 132 132
Oftentimes, people will call a statistical 133 133
or profile-based detection. 134 134
Essentially, we create a baseline 135 135
and anything that's outside of that, we're going to flag. 136 136
So for instance, here on the screen, 137 137
you can see a basic baseline 138 138
or a scattergram of a bunch of different events, 139 139
and you see that one all the way in the far right corner. 140 140
That's the outlier. 141 141
That one is outside of the band of tolerance, 142 142
and so we want to go investigate it. 143 143
That's the idea here with behavioral analysis. 144 144
Now, behavioral analysis is going to generate a lot 145 145
of false positives for you, 146 146
so this is something you have to be aware of. 147 147
It's also going to create a lot of false negatives. 148 148
Now, this is going to happen 149 149
until your statistical model is adequately trained 150 150
and tuned. 151 151
Just like heuristical scans, they do need to learn, 152 152
and as they learn more over time, 153 153
they are going to be better off and do a better job for you 154 154
as you start figuring out exactly what is your baseline, 155 155
and what is your tolerance level, 156 156
and then what is going to be something 157 157
that's outside that baseline? 158 158
Now the fourth and final type we have 159 159
is what's known as anomaly analysis. 160 160
Now, an anomaly analysis is a network monitoring system 161 161
that uses a baseline of acceptable outcomes 162 162
or event patterns to identify events 163 163
that fall outside unacceptable range. 164 164
Now, I know this sounds a lot like behavioral analysis, 165 165
but there is a difference, and I'm going to get to that 166 166
in just a second. 167 167
With anomaly analysis, we're going to generate an alert 168 168
on any event or outcome that doesn't follow 169 169
a set pattern or rule. 170 170
So let me give you a good example of this. 171 171
Let's say I'm sending data back and forth. 172 172
Well, if I'm doing that, I'm probably doing it 173 173
over the network and I'm doing it using packets. 174 174
Well, my engine might check the packet headers 175 175
or the exchange of packets in a session, 176 176
and then based on that, if it's not conforming 177 177
to the RFC standard that everybody conforms to, 178 178
I'm going to generate an alert 179 179
because it's something that deviates 180 180
from the strict compliance of that RFC. 181 181
Now, this is the idea of anomaly analysis. 182 182
It allows you to say, hey, this doesn't meet the standard. 183 183
This looks weird. 184 184
And so if somebody's sending something like a ping of death, 185 185
that would get caught by an anomaly analysis, 186 186
because it's not normal to get a ping 187 187
of death packet, because that goes outside 188 188
of the RFC by using weird sizes inside the packet headers. 189 189
Now, what is the difference here 190 190
between an anomaly analysis and a behavioral analysis? 191 191
Well, with an anomaly analysis, 192 192
this is going to use prescribed patterns 193 193
like an RFC or an industry standard, 194 194
something that everybody should be following. 195 195
Now, behavioral analysis, 196 196
on the other hand, records expected patterns 197 197
in relation to the device being monitored. 198 198
So with anomaly analysis, we are looking 199 199
at everything following a standard. 200 200
With behavioral analysis, 201 201
we are making up our own standard 202 202
based on the observe patterns on that device. 203 203
So if I create a baseline based on my web server, 204 204
not any web server, that's really the difference 205 205
between behavioral analysis and anomaly analysis.