1 1 00:00:00,330 --> 00:00:02,640 Analysis and detection. 2 2 00:00:02,640 --> 00:00:04,200 So now that we've covered the overview 3 3 00:00:04,200 --> 00:00:05,430 and we've looked at the dashboard, 4 4 00:00:05,430 --> 00:00:07,290 which brings up those metrics, 5 5 00:00:07,290 --> 00:00:09,960 how do we do our analysis and our detection? 6 6 00:00:09,960 --> 00:00:11,100 When we talk about our SIEM, 7 7 00:00:11,100 --> 00:00:12,510 there is lots of different data 8 8 00:00:12,510 --> 00:00:14,370 that's being put into the SIEM, 9 9 00:00:14,370 --> 00:00:16,440 and the SIEM has to apply different rules 10 10 00:00:16,440 --> 00:00:18,420 to all those different inputs and outputs 11 11 00:00:18,420 --> 00:00:20,430 to match and create alerts for us. 12 12 00:00:20,430 --> 00:00:22,200 Those alerts are going to allow the analysts 13 13 00:00:22,200 --> 00:00:23,760 to start investigating it. 14 14 00:00:23,760 --> 00:00:24,840 Well, an analyst needs to go 15 15 00:00:24,840 --> 00:00:26,310 through all of these different alerts, 16 16 00:00:26,310 --> 00:00:28,560 and they need to dismiss the false positives 17 17 00:00:28,560 --> 00:00:31,110 while they are responding to those true positives. 18 18 00:00:31,110 --> 00:00:32,730 Essentially, we're going to have a lot of things 19 19 00:00:32,730 --> 00:00:33,563 that are positive, 20 20 00:00:33,563 --> 00:00:34,890 and that's what we're going to be looking at. 21 21 00:00:34,890 --> 00:00:37,170 And then we're going to sort them out into false positive, 22 22 00:00:37,170 --> 00:00:38,970 meaning it wasn't really a bad thing 23 23 00:00:38,970 --> 00:00:41,340 or true positive, meaning it was a bad thing, 24 24 00:00:41,340 --> 00:00:43,440 and now we're going to go respond to it. 25 25 00:00:43,440 --> 00:00:45,330 Now, there's lots of different ways to do this, 26 26 00:00:45,330 --> 00:00:46,470 and we're going to look at this 27 27 00:00:46,470 --> 00:00:49,230 under a couple of different ways that we do our analysis. 28 28 00:00:49,230 --> 00:00:52,410 We can have conditional analysis, heuristic analysis, 29 29 00:00:52,410 --> 00:00:55,440 behavioral analysis, or anomaly analysis. 30 30 00:00:55,440 --> 00:00:57,570 Let's go through each of these in this lesson. 31 31 00:00:57,570 --> 00:00:59,670 First, conditional analysis. 32 32 00:00:59,670 --> 00:01:02,880 Now, conditional analysis is a simple form of correlation 33 33 00:01:02,880 --> 00:01:04,320 that's performed by a machine 34 34 00:01:04,320 --> 00:01:07,740 using signature detection and rules-based policies. 35 35 00:01:07,740 --> 00:01:09,840 Now, the great thing about using something like this 36 36 00:01:09,840 --> 00:01:11,550 is that it is very clear cut. 37 37 00:01:11,550 --> 00:01:14,250 When you have an alert pop up on your screen as an analyst, 38 38 00:01:14,250 --> 00:01:15,360 usually it's because there 39 39 00:01:15,360 --> 00:01:17,640 is some kind of a signature or rule. 40 40 00:01:17,640 --> 00:01:20,130 That conditional analysis is going to use a signature or rule 41 41 00:01:20,130 --> 00:01:21,510 to generate that alert, 42 42 00:01:21,510 --> 00:01:22,800 and usually, it's going to be in the form 43 43 00:01:22,800 --> 00:01:27,690 of if this aler, or if this and this or this alert. 44 44 00:01:27,690 --> 00:01:31,680 So if I have something like if X and Y or Z, 45 45 00:01:31,680 --> 00:01:34,200 this is going to say either Y or Z happens, 46 46 00:01:34,200 --> 00:01:35,910 and X also happened, 47 47 00:01:35,910 --> 00:01:37,470 then we're going to create an alert. 48 48 00:01:37,470 --> 00:01:39,420 Now, there is a problem using this approach 49 49 00:01:39,420 --> 00:01:42,330 of using signature-based or rules-based policies. 50 50 00:01:42,330 --> 00:01:43,470 This is because all 51 51 00:01:43,470 --> 00:01:45,120 of these things have to have a rule created, 52 52 00:01:45,120 --> 00:01:47,790 and if you don't have a rule created, you're going to be blind 53 53 00:01:47,790 --> 00:01:51,300 to any kind of zero day or previously unknown TTPs. 54 54 00:01:51,300 --> 00:01:52,410 Also, this type 55 55 00:01:52,410 --> 00:01:54,442 of conditional analysis creates a large number 56 56 00:01:54,442 --> 00:01:58,080 of false positives because these rules are very basic, 57 57 00:01:58,080 --> 00:02:00,787 and they don't understand the intricacies of human behavior, 58 58 00:02:00,787 --> 00:02:03,150 and so often these rules can alert 59 59 00:02:03,150 --> 00:02:05,280 even though there's nothing bad going on. 60 60 00:02:05,280 --> 00:02:07,260 So this brings us to our second category, 61 61 00:02:07,260 --> 00:02:09,450 which is known as heuristic analysis. 62 62 00:02:09,450 --> 00:02:11,250 A heuristic analysis is a method 63 63 00:02:11,250 --> 00:02:13,800 that uses feature comparisons and likenesses 64 64 00:02:13,800 --> 00:02:16,290 rather than specific signature matching to identify 65 65 00:02:16,290 --> 00:02:19,650 whether the target of observation is really malicious. 66 66 00:02:19,650 --> 00:02:21,886 For example, if I said, if you see a man 67 67 00:02:21,886 --> 00:02:26,886 and he has brown or white hair, he might be malicious. 68 68 00:02:27,000 --> 00:02:28,560 That's a pretty generic rule. 69 69 00:02:28,560 --> 00:02:29,850 That would be a signature-based 70 70 00:02:29,850 --> 00:02:31,650 or conditional analysis type rule. 71 71 00:02:31,650 --> 00:02:33,210 And you're going to have a ton of false positives 72 72 00:02:33,210 --> 00:02:34,980 because I'm looking for one bad guy 73 73 00:02:34,980 --> 00:02:36,300 who might have robbed a store, 74 74 00:02:36,300 --> 00:02:37,530 but now I'm looking for everybody 75 75 00:02:37,530 --> 00:02:40,110 who is a man and has brown or white hair. 76 76 00:02:40,110 --> 00:02:41,790 Well, I can also go into heuristics 77 77 00:02:41,790 --> 00:02:44,400 and I can start adding some things that look like that, 78 78 00:02:44,400 --> 00:02:45,870 but not exactly that. 79 79 00:02:45,870 --> 00:02:49,590 So now I'm looking for a man who has brown hair, 80 80 00:02:49,590 --> 00:02:51,990 or maybe something between brown and white, 81 81 00:02:51,990 --> 00:02:53,790 because it wasn't either brown or white, 82 82 00:02:53,790 --> 00:02:55,110 it was somewhere in between. 83 83 00:02:55,110 --> 00:02:56,820 And so as we get this kind of heuristics, 84 84 00:02:56,820 --> 00:02:58,680 we can start seeing things that look like it 85 85 00:02:58,680 --> 00:02:59,806 but aren't exact. 86 86 00:02:59,806 --> 00:03:02,670 Now, when you're using heuristical analysis like this, 87 87 00:03:02,670 --> 00:03:04,320 this is going to end up using machine learning 88 88 00:03:04,320 --> 00:03:06,198 to help you alert on behavior that's similar enough 89 89 00:03:06,198 --> 00:03:09,660 to a signature or rule, but it isn't necessarily exact. 90 90 00:03:09,660 --> 00:03:10,493 Now, the benefit 91 91 00:03:10,493 --> 00:03:13,350 of this is bad guys are really, really smart. 92 92 00:03:13,350 --> 00:03:14,490 And so if they start realizing 93 93 00:03:14,490 --> 00:03:16,560 that if they do this exact pattern, 94 94 00:03:16,560 --> 00:03:18,780 it's going to flag a sensor based on a signature, 95 95 00:03:18,780 --> 00:03:20,070 they're going to modify that pattern 96 96 00:03:20,070 --> 00:03:22,860 just a little bit to make it harder to find them. 97 97 00:03:22,860 --> 00:03:25,431 Well, heuristic signatures can find those things 98 98 00:03:25,431 --> 00:03:27,570 by using this machine learning. 99 99 00:03:27,570 --> 00:03:28,590 By using machine learning, 100 100 00:03:28,590 --> 00:03:29,550 we're using a component 101 101 00:03:29,550 --> 00:03:31,855 of AI that enables machines to develop strategies 102 102 00:03:31,855 --> 00:03:34,920 for solving a task given a labeled dataset 103 103 00:03:34,920 --> 00:03:37,350 where features have been manually identified, 104 104 00:03:37,350 --> 00:03:39,810 but without further explicit instructions. 105 105 00:03:39,810 --> 00:03:41,520 Now, the reason we use machine learning 106 106 00:03:41,520 --> 00:03:43,830 is because there is just so much data out there, 107 107 00:03:43,830 --> 00:03:45,060 and we don't have enough analysts 108 108 00:03:45,060 --> 00:03:46,560 to go through every single alert 109 109 00:03:46,560 --> 00:03:48,930 and try to make all these determinations for us. 110 110 00:03:48,930 --> 00:03:50,460 So by combining machine learning 111 111 00:03:50,460 --> 00:03:53,040 with the heuristic analysis, we can start going through 112 112 00:03:53,040 --> 00:03:54,960 and having the machines learn over time 113 113 00:03:54,960 --> 00:03:58,020 what exactly is bad and what exactly is good, 114 114 00:03:58,020 --> 00:04:00,180 and they can do a better job of that than humans can 115 115 00:04:00,180 --> 00:04:02,850 because they can process so much more information faster. 116 116 00:04:02,850 --> 00:04:05,330 Now, this will end up having a lot of false positives. 117 117 00:04:05,330 --> 00:04:07,710 This can have a lot of false negatives as well, 118 118 00:04:07,710 --> 00:04:09,870 but over time, your heuristics get much, 119 119 00:04:09,870 --> 00:04:12,150 much better when they have a good trained data set, 120 120 00:04:12,150 --> 00:04:14,490 and they can learn over time and do a better job for you, 121 121 00:04:14,490 --> 00:04:17,970 and this helps our analysts relieve a lot of that workload. 122 122 00:04:17,970 --> 00:04:19,560 Now, the third type we have is what's known 123 123 00:04:19,560 --> 00:04:21,300 as behavioral analysis. 124 124 00:04:21,300 --> 00:04:22,920 When we deal with behavioral analysis 125 125 00:04:22,920 --> 00:04:25,065 we have a network monitoring system that detects changes 126 126 00:04:25,065 --> 00:04:27,570 in normal operating data sequences 127 127 00:04:27,570 --> 00:04:29,790 and identifies abnormal sequences. 128 128 00:04:29,790 --> 00:04:30,780 So what we're really looking 129 129 00:04:30,780 --> 00:04:33,330 for with behavioral analysis is to generate an alert 130 130 00:04:33,330 --> 00:04:34,941 whenever anything deviates outside 131 131 00:04:34,941 --> 00:04:38,640 of a defined level of tolerance from a given baseline. 132 132 00:04:38,640 --> 00:04:40,770 Oftentimes, people will call a statistical 133 133 00:04:40,770 --> 00:04:42,660 or profile-based detection. 134 134 00:04:42,660 --> 00:04:44,280 Essentially, we create a baseline 135 135 00:04:44,280 --> 00:04:46,392 and anything that's outside of that, we're going to flag. 136 136 00:04:46,392 --> 00:04:48,240 So for instance, here on the screen, 137 137 00:04:48,240 --> 00:04:49,860 you can see a basic baseline 138 138 00:04:49,860 --> 00:04:52,140 or a scattergram of a bunch of different events, 139 139 00:04:52,140 --> 00:04:54,540 and you see that one all the way in the far right corner. 140 140 00:04:54,540 --> 00:04:55,800 That's the outlier. 141 141 00:04:55,800 --> 00:04:57,900 That one is outside of the band of tolerance, 142 142 00:04:57,900 --> 00:04:59,760 and so we want to go investigate it. 143 143 00:04:59,760 --> 00:05:02,100 That's the idea here with behavioral analysis. 144 144 00:05:02,100 --> 00:05:04,440 Now, behavioral analysis is going to generate a lot 145 145 00:05:04,440 --> 00:05:05,520 of false positives for you, 146 146 00:05:05,520 --> 00:05:07,080 so this is something you have to be aware of. 147 147 00:05:07,080 --> 00:05:09,150 It's also going to create a lot of false negatives. 148 148 00:05:09,150 --> 00:05:10,110 Now, this is going to happen 149 149 00:05:10,110 --> 00:05:12,540 until your statistical model is adequately trained 150 150 00:05:12,540 --> 00:05:13,530 and tuned. 151 151 00:05:13,530 --> 00:05:15,876 Just like heuristical scans, they do need to learn, 152 152 00:05:15,876 --> 00:05:17,779 and as they learn more over time, 153 153 00:05:17,779 --> 00:05:20,910 they are going to be better off and do a better job for you 154 154 00:05:20,910 --> 00:05:23,370 as you start figuring out exactly what is your baseline, 155 155 00:05:23,370 --> 00:05:24,930 and what is your tolerance level, 156 156 00:05:24,930 --> 00:05:26,160 and then what is going to be something 157 157 00:05:26,160 --> 00:05:28,200 that's outside that baseline? 158 158 00:05:28,200 --> 00:05:29,609 Now the fourth and final type we have 159 159 00:05:29,609 --> 00:05:31,751 is what's known as anomaly analysis. 160 160 00:05:31,751 --> 00:05:34,920 Now, an anomaly analysis is a network monitoring system 161 161 00:05:34,920 --> 00:05:37,170 that uses a baseline of acceptable outcomes 162 162 00:05:37,170 --> 00:05:39,300 or event patterns to identify events 163 163 00:05:39,300 --> 00:05:41,240 that fall outside unacceptable range. 164 164 00:05:41,240 --> 00:05:43,927 Now, I know this sounds a lot like behavioral analysis, 165 165 00:05:43,927 --> 00:05:46,050 but there is a difference, and I'm going to get to that 166 166 00:05:46,050 --> 00:05:47,370 in just a second. 167 167 00:05:47,370 --> 00:05:49,447 With anomaly analysis, we're going to generate an alert 168 168 00:05:49,447 --> 00:05:51,537 on any event or outcome that doesn't follow 169 169 00:05:51,537 --> 00:05:53,910 a set pattern or rule. 170 170 00:05:53,910 --> 00:05:55,380 So let me give you a good example of this. 171 171 00:05:55,380 --> 00:05:57,539 Let's say I'm sending data back and forth. 172 172 00:05:57,539 --> 00:05:59,190 Well, if I'm doing that, I'm probably doing it 173 173 00:05:59,190 --> 00:06:01,500 over the network and I'm doing it using packets. 174 174 00:06:01,500 --> 00:06:04,080 Well, my engine might check the packet headers 175 175 00:06:04,080 --> 00:06:06,120 or the exchange of packets in a session, 176 176 00:06:06,120 --> 00:06:08,190 and then based on that, if it's not conforming 177 177 00:06:08,190 --> 00:06:11,280 to the RFC standard that everybody conforms to, 178 178 00:06:11,280 --> 00:06:12,390 I'm going to generate an alert 179 179 00:06:12,390 --> 00:06:13,890 because it's something that deviates 180 180 00:06:13,890 --> 00:06:16,557 from the strict compliance of that RFC. 181 181 00:06:16,557 --> 00:06:18,905 Now, this is the idea of anomaly analysis. 182 182 00:06:18,905 --> 00:06:22,200 It allows you to say, hey, this doesn't meet the standard. 183 183 00:06:22,200 --> 00:06:23,580 This looks weird. 184 184 00:06:23,580 --> 00:06:25,620 And so if somebody's sending something like a ping of death, 185 185 00:06:25,620 --> 00:06:27,840 that would get caught by an anomaly analysis, 186 186 00:06:27,840 --> 00:06:29,310 because it's not normal to get a ping 187 187 00:06:29,310 --> 00:06:31,650 of death packet, because that goes outside 188 188 00:06:31,650 --> 00:06:35,580 of the RFC by using weird sizes inside the packet headers. 189 189 00:06:35,580 --> 00:06:36,720 Now, what is the difference here 190 190 00:06:36,720 --> 00:06:39,810 between an anomaly analysis and a behavioral analysis? 191 191 00:06:39,810 --> 00:06:41,550 Well, with an anomaly analysis, 192 192 00:06:41,550 --> 00:06:43,170 this is going to use prescribed patterns 193 193 00:06:43,170 --> 00:06:45,450 like an RFC or an industry standard, 194 194 00:06:45,450 --> 00:06:47,730 something that everybody should be following. 195 195 00:06:47,730 --> 00:06:48,870 Now, behavioral analysis, 196 196 00:06:48,870 --> 00:06:50,880 on the other hand, records expected patterns 197 197 00:06:50,880 --> 00:06:53,190 in relation to the device being monitored. 198 198 00:06:53,190 --> 00:06:55,020 So with anomaly analysis, we are looking 199 199 00:06:55,020 --> 00:06:56,820 at everything following a standard. 200 200 00:06:56,820 --> 00:06:58,050 With behavioral analysis, 201 201 00:06:58,050 --> 00:06:59,520 we are making up our own standard 202 202 00:06:59,520 --> 00:07:02,520 based on the observe patterns on that device. 203 203 00:07:02,520 --> 00:07:05,160 So if I create a baseline based on my web server, 204 204 00:07:05,160 --> 00:07:07,677 not any web server, that's really the difference 205 205 00:07:07,677 --> 00:07:10,773 between behavioral analysis and anomaly analysis.