1 1 00:00:00,540 --> 00:00:02,070 Trend Analysis. 2 2 00:00:02,070 --> 00:00:05,970 In this lesson, we are going to talk all about trend analysis. 3 3 00:00:05,970 --> 00:00:08,940 Now, trend analysis is the process of detecting patterns 4 4 00:00:08,940 --> 00:00:10,920 within a dataset over time 5 5 00:00:10,920 --> 00:00:12,870 and using those patterns to make predictions 6 6 00:00:12,870 --> 00:00:16,500 about future events or better understand our past events. 7 7 00:00:16,500 --> 00:00:18,360 Now, the whole idea here with trend analysis 8 8 00:00:18,360 --> 00:00:20,460 is we should understand what a baseline looks like. 9 9 00:00:20,460 --> 00:00:22,500 What does our system normally look like? 10 10 00:00:22,500 --> 00:00:24,990 And then, what goes outside that trend? 11 11 00:00:24,990 --> 00:00:26,555 If that trend starts going up or down 12 12 00:00:26,555 --> 00:00:28,680 or goes way off to the side, 13 13 00:00:28,680 --> 00:00:30,000 that is something that we want to know 14 14 00:00:30,000 --> 00:00:32,250 because it might mean that either an attack is coming 15 15 00:00:32,250 --> 00:00:35,550 because it's trending upward, or something already happened 16 16 00:00:35,550 --> 00:00:37,650 and that's why we see this big spike. 17 17 00:00:37,650 --> 00:00:39,210 Now, when we deal with trend analysis, 18 18 00:00:39,210 --> 00:00:41,250 this can enable us to review past events 19 19 00:00:41,250 --> 00:00:43,290 from a new perspective as well. 20 20 00:00:43,290 --> 00:00:45,330 For instance, if I look back over my logs 21 21 00:00:45,330 --> 00:00:46,950 for the last six months and I see 22 22 00:00:46,950 --> 00:00:49,830 there was a big spike back in, say, three months ago, 23 23 00:00:49,830 --> 00:00:51,000 I can then go back three months 24 24 00:00:51,000 --> 00:00:52,260 and start investigating that. 25 25 00:00:52,260 --> 00:00:54,030 Now, by going back and looking at that event 26 26 00:00:54,030 --> 00:00:56,940 over this time period, we can see where those patterns are, 27 27 00:00:56,940 --> 00:00:59,850 and we can identify what goes outside the pattern. 28 28 00:00:59,850 --> 00:01:02,010 This is really important because it is really impossible 29 29 00:01:02,010 --> 00:01:04,080 to identify a trend when you're just looking 30 30 00:01:04,080 --> 00:01:05,910 at a single logged event. 31 31 00:01:05,910 --> 00:01:07,470 For instance, back in elementary school 32 32 00:01:07,470 --> 00:01:08,850 when you learned how to graph things 33 33 00:01:08,850 --> 00:01:10,560 on a piece of graph paper, 34 34 00:01:10,560 --> 00:01:12,390 you would go and put a single dot. 35 35 00:01:12,390 --> 00:01:14,430 And you wouldn't really know what that really meant. 36 36 00:01:14,430 --> 00:01:15,510 But if you put a second dot 37 37 00:01:15,510 --> 00:01:17,400 and then a third dot and a fourth dot, 38 38 00:01:17,400 --> 00:01:19,620 you could start seeing where those trends go over time. 39 39 00:01:19,620 --> 00:01:20,880 And that trend is really important 40 40 00:01:20,880 --> 00:01:22,710 because it starts to tell you a lot more 41 41 00:01:22,710 --> 00:01:24,990 than any single event could on its own. 42 42 00:01:24,990 --> 00:01:26,670 Now, when we deal with trend analysis, 43 43 00:01:26,670 --> 00:01:28,980 there is three different kinds that we can deal with. 44 44 00:01:28,980 --> 00:01:31,020 We have frequency-based trend analysis, 45 45 00:01:31,020 --> 00:01:32,580 volume-based trend analysis, 46 46 00:01:32,580 --> 00:01:35,190 and statistical deviation trend analysis. 47 47 00:01:35,190 --> 00:01:37,740 Let's talk about each of those as we go through this lesson. 48 48 00:01:37,740 --> 00:01:40,350 First, we have frequency-based analysis. 49 49 00:01:40,350 --> 00:01:42,150 Now, when we deal with frequency-based analysis, 50 50 00:01:42,150 --> 00:01:45,240 this is going to establish a baseline for a given metric 51 51 00:01:45,240 --> 00:01:46,740 and then monitor the number of times 52 52 00:01:46,740 --> 00:01:49,740 that occurrence happens over a given period of time. 53 53 00:01:49,740 --> 00:01:51,390 For example, here on the screen, 54 54 00:01:51,390 --> 00:01:53,337 you can see the notable events over time. 55 55 00:01:53,337 --> 00:01:55,950 And you can see how the count goes up and down 56 56 00:01:55,950 --> 00:01:57,540 over a given period of time 57 57 00:01:57,540 --> 00:01:59,070 based on what the different events are. 58 58 00:01:59,070 --> 00:02:01,740 For instance, I can see there's a big spike on access 59 59 00:02:01,740 --> 00:02:03,390 at around 7 PM at night 60 60 00:02:03,390 --> 00:02:05,670 and then again around 7:00 to 8:00 in the morning. 61 61 00:02:05,670 --> 00:02:07,590 Those are times, probably, when there was a shift change 62 62 00:02:07,590 --> 00:02:09,060 between two different analysts, 63 63 00:02:09,060 --> 00:02:10,440 and so somebody had to log on 64 64 00:02:10,440 --> 00:02:13,290 when all the new shift came on and all the shift went off. 65 65 00:02:13,290 --> 00:02:14,550 That was the idea there. 66 66 00:02:14,550 --> 00:02:17,220 We can also see a couple of spikes around 9 AM 67 67 00:02:17,220 --> 00:02:18,870 on the right side of the chart. 68 68 00:02:18,870 --> 00:02:21,060 There I see there's a red one and a yellow one. 69 69 00:02:21,060 --> 00:02:22,560 The red indicates endpoint. 70 70 00:02:22,560 --> 00:02:23,610 And then shortly after that, 71 71 00:02:23,610 --> 00:02:25,620 we see an increase in the threat as well. 72 72 00:02:25,620 --> 00:02:27,570 This shows us that the endpoints were logging something 73 73 00:02:27,570 --> 00:02:30,390 and shortly after, we started seeing threats rise as well. 74 74 00:02:30,390 --> 00:02:32,190 And so, we start having additional information 75 75 00:02:32,190 --> 00:02:33,960 that we can start putting all that together 76 76 00:02:33,960 --> 00:02:36,030 as part of our frequency-based analysis. 77 77 00:02:36,030 --> 00:02:38,940 The next one we want to talk about is volume-based analysis. 78 78 00:02:38,940 --> 00:02:41,580 Now, volume-based analysis is going to measure a metric 79 79 00:02:41,580 --> 00:02:43,140 based on the size of something, 80 80 00:02:43,140 --> 00:02:44,970 such as how much disk space is being used 81 81 00:02:44,970 --> 00:02:46,770 or the log file size that's being used 82 82 00:02:46,770 --> 00:02:48,030 or something like that. 83 83 00:02:48,030 --> 00:02:49,230 For example, let's take a look 84 84 00:02:49,230 --> 00:02:51,540 at our database server network utilization. 85 85 00:02:51,540 --> 00:02:53,430 Last week it was 40 megabytes. 86 86 00:02:53,430 --> 00:02:55,530 This week it was 800 megabytes. 87 87 00:02:55,530 --> 00:02:57,390 That is a 20 time increase. 88 88 00:02:57,390 --> 00:02:58,950 Now is that good or is that bad? 89 89 00:02:58,950 --> 00:03:01,170 Well, it could be good, it could be bad. 90 90 00:03:01,170 --> 00:03:02,220 We really don't know. 91 91 00:03:02,220 --> 00:03:04,170 But it is something that we should identify. 92 92 00:03:04,170 --> 00:03:05,130 This is a unique thing. 93 93 00:03:05,130 --> 00:03:07,680 It's an anomaly that goes outside of our trend 94 94 00:03:07,680 --> 00:03:09,540 based on our usual volume. 95 95 00:03:09,540 --> 00:03:11,580 Now, if I had multiple weeks to look at this, 96 96 00:03:11,580 --> 00:03:15,120 I could say it's usually around 30 to 40 to 50 megabytes. 97 97 00:03:15,120 --> 00:03:17,130 This week it jumped up to 800. 98 98 00:03:17,130 --> 00:03:18,510 Well, that's something I want to look into 99 99 00:03:18,510 --> 00:03:21,390 because maybe I'm the victim of a data exfiltration 100 100 00:03:21,390 --> 00:03:23,160 and they're dumping my entire database 101 101 00:03:23,160 --> 00:03:24,150 over to their servers. 102 102 00:03:24,150 --> 00:03:26,820 And that would show a huge volume of network utilization 103 103 00:03:26,820 --> 00:03:28,110 and so we'd want to look into that. 104 104 00:03:28,110 --> 00:03:30,210 That's where volume-based can really help you out. 105 105 00:03:30,210 --> 00:03:33,330 The third type we have is statistical deviation analysis. 106 106 00:03:33,330 --> 00:03:35,370 Now, this is going to use the concept of mean 107 107 00:03:35,370 --> 00:03:37,410 and standard deviations to determine 108 108 00:03:37,410 --> 00:03:40,500 if a data point should be treated as suspicious. 109 109 00:03:40,500 --> 00:03:42,870 Now, this is a math term when you talk about mean. 110 110 00:03:42,870 --> 00:03:44,340 Mean is basically the average. 111 111 00:03:44,340 --> 00:03:45,930 It's the sum of all the values 112 112 00:03:45,930 --> 00:03:47,880 divided by the number of samples. 113 113 00:03:47,880 --> 00:03:51,060 So for example, on this chart you can see the blue line. 114 114 00:03:51,060 --> 00:03:51,900 That's the mean. 115 115 00:03:51,900 --> 00:03:54,780 We expect a one-to-one or a two-to-two correlation 116 116 00:03:54,780 --> 00:03:56,160 as we go up the line. 117 117 00:03:56,160 --> 00:03:58,200 Now, if we have something that goes far outside of that, 118 118 00:03:58,200 --> 00:04:01,200 for example the green dot which is showing at 4.5 119 119 00:04:01,200 --> 00:04:02,970 and one going upward, 120 120 00:04:02,970 --> 00:04:05,250 this is something that is way outside the norm. 121 121 00:04:05,250 --> 00:04:07,020 Now, what does this graph represent? 122 122 00:04:07,020 --> 00:04:08,910 Well, nothing really, it's just an example. 123 123 00:04:08,910 --> 00:04:11,070 But it could represent lots of different things. 124 124 00:04:11,070 --> 00:04:13,440 For example, what if these data points were showing us 125 125 00:04:13,440 --> 00:04:15,330 the relationship between the standard users 126 126 00:04:15,330 --> 00:04:16,560 and the privilege users, 127 127 00:04:16,560 --> 00:04:18,690 and how many times they're invoking a process 128 128 00:04:18,690 --> 00:04:20,010 and how they're running it? 129 129 00:04:20,010 --> 00:04:22,020 For instance, if I have one user account 130 130 00:04:22,020 --> 00:04:24,150 but I'm logging into 4 1/2 different systems, 131 131 00:04:24,150 --> 00:04:25,350 that would be unusual. 132 132 00:04:25,350 --> 00:04:26,280 If I had one user account 133 133 00:04:26,280 --> 00:04:28,380 and I'm logging into one system, that would be normal. 134 134 00:04:28,380 --> 00:04:29,640 The example on the screen here 135 135 00:04:29,640 --> 00:04:31,410 doesn't really matter what those axises are. 136 136 00:04:31,410 --> 00:04:32,820 It just showing you the concept. 137 137 00:04:32,820 --> 00:04:33,780 When we start seeing something 138 138 00:04:33,780 --> 00:04:37,110 that is outside the standard mean or outside the average 139 139 00:04:37,110 --> 00:04:38,460 that is when we're going to flag on it 140 140 00:04:38,460 --> 00:04:41,340 and that's called a statistical deviation analysis. 141 141 00:04:41,340 --> 00:04:42,600 Now, one thing to keep in mind 142 142 00:04:42,600 --> 00:04:44,340 when you're dealing with trend analysis is 143 143 00:04:44,340 --> 00:04:46,410 that your trend analysis is going to be very dependent 144 144 00:04:46,410 --> 00:04:47,790 on what metrics are used 145 145 00:04:47,790 --> 00:04:49,920 for your baseline and your measurement. 146 146 00:04:49,920 --> 00:04:51,450 If you're not measuring the right things, 147 147 00:04:51,450 --> 00:04:53,400 you can miss bad things that are happening. 148 148 00:04:53,400 --> 00:04:54,690 If you're measuring the right things, 149 149 00:04:54,690 --> 00:04:56,490 but you don't watch those things over time, 150 150 00:04:56,490 --> 00:04:57,990 you can miss things as well. 151 151 00:04:57,990 --> 00:04:59,880 So you have to make sure you pick exactly 152 152 00:04:59,880 --> 00:05:00,720 what you want to measure. 153 153 00:05:00,720 --> 00:05:02,910 And, given the resources you have, 154 154 00:05:02,910 --> 00:05:04,920 which ones you're going to actually look at 155 155 00:05:04,920 --> 00:05:06,540 and analyze using your analyst 156 156 00:05:06,540 --> 00:05:09,600 because you only have so many people and only so much time. 157 157 00:05:09,600 --> 00:05:11,040 So when it comes to trend analysis, 158 158 00:05:11,040 --> 00:05:13,110 you have to figure out what you're going to measure. 159 159 00:05:13,110 --> 00:05:14,730 And, there's lots of things you could measure. 160 160 00:05:14,730 --> 00:05:16,320 You could measure the number of alerts 161 161 00:05:16,320 --> 00:05:17,340 and the number of incidents 162 162 00:05:17,340 --> 00:05:19,140 and see how these trend over time. 163 163 00:05:19,140 --> 00:05:20,820 You might look at the time to respond 164 164 00:05:20,820 --> 00:05:22,860 and how quickly is this going up or down? 165 165 00:05:22,860 --> 00:05:25,140 Are you getting better at doing responses? 166 166 00:05:25,140 --> 00:05:26,370 How about the number of network 167 167 00:05:26,370 --> 00:05:27,810 or host metrics that there are? 168 168 00:05:27,810 --> 00:05:29,430 You might be looking at network bandwidth. 169 169 00:05:29,430 --> 00:05:31,440 You might be looking at volume of storage. 170 170 00:05:31,440 --> 00:05:33,360 You might be looking at log files. 171 171 00:05:33,360 --> 00:05:35,190 You might be looking at number of log-ons. 172 172 00:05:35,190 --> 00:05:37,050 You might look at number of active ports. 173 173 00:05:37,050 --> 00:05:39,690 There's tons of different metrics you can choose from. 174 174 00:05:39,690 --> 00:05:41,490 You might also look at training and education 175 175 00:05:41,490 --> 00:05:42,990 and we've talked about this before. 176 176 00:05:42,990 --> 00:05:46,200 How well informed is your staff in regards to cyber threats? 177 177 00:05:46,200 --> 00:05:48,330 Do they know what phishing emails look like? 178 178 00:05:48,330 --> 00:05:50,430 How many times have you given these programs in a year? 179 179 00:05:50,430 --> 00:05:51,810 How many people have gone through? 180 180 00:05:51,810 --> 00:05:53,640 How have they done their grade assessments? 181 181 00:05:53,640 --> 00:05:54,840 Have you done pen tests to see 182 182 00:05:54,840 --> 00:05:56,790 if they fall for these type of tricks? 183 183 00:05:56,790 --> 00:05:57,799 How about compliance? 184 184 00:05:57,799 --> 00:06:01,140 How well are your systems complying to your baseline? 185 185 00:06:01,140 --> 00:06:02,070 Are they all patched? 186 186 00:06:02,070 --> 00:06:03,270 Are they all scanned? 187 187 00:06:03,270 --> 00:06:05,220 Are they all have up to date antivirus? 188 188 00:06:05,220 --> 00:06:06,053 How many of them are up? 189 189 00:06:06,053 --> 00:06:07,170 How many of them are down? 190 190 00:06:07,170 --> 00:06:09,120 All of this is data you could be looking at. 191 191 00:06:09,120 --> 00:06:11,760 And then finally, how about your external threat levels? 192 192 00:06:11,760 --> 00:06:13,530 What is the external threat level look like 193 193 00:06:13,530 --> 00:06:14,790 right now in the world? 194 194 00:06:14,790 --> 00:06:16,860 As you keep reading about different cyber threats 195 195 00:06:16,860 --> 00:06:17,760 that are out there, 196 196 00:06:17,760 --> 00:06:18,750 do they apply to you? 197 197 00:06:18,750 --> 00:06:20,250 Are they all going after Window systems, 198 198 00:06:20,250 --> 00:06:21,510 but you're using Linux? 199 199 00:06:21,510 --> 00:06:22,590 Or, are you using Linux 200 200 00:06:22,590 --> 00:06:24,240 and they're going after Linux systems? 201 201 00:06:24,240 --> 00:06:25,410 Are you in an industry right now 202 202 00:06:25,410 --> 00:06:27,120 that everybody seems to be attacking? 203 203 00:06:27,120 --> 00:06:29,250 For instance, maybe you work for a credit card processor 204 204 00:06:29,250 --> 00:06:31,500 or a bank and you see that this industry 205 205 00:06:31,500 --> 00:06:33,180 has been targeted week after week, 206 206 00:06:33,180 --> 00:06:35,430 month after month, year after year. 207 207 00:06:35,430 --> 00:06:36,747 Or maybe you work for a software company 208 208 00:06:36,747 --> 00:06:39,000 and you realize nobody's really going after them 209 209 00:06:39,000 --> 00:06:40,230 so you're not as worried. 210 210 00:06:40,230 --> 00:06:42,150 That external threat level does make a difference 211 211 00:06:42,150 --> 00:06:44,040 and you have to keep that in mind too. 212 212 00:06:44,040 --> 00:06:45,420 Now, one other thing I want to talk about 213 213 00:06:45,420 --> 00:06:47,370 when we talk about trend analysis is 214 214 00:06:47,370 --> 00:06:49,530 that trend analysis can help you figure out 215 215 00:06:49,530 --> 00:06:52,020 if you're being the victim of a sparse attack. 216 216 00:06:52,020 --> 00:06:53,610 Now, what is a sparse attack? 217 217 00:06:53,610 --> 00:06:56,490 Well, sometimes attackers will use a sparse attack technique 218 218 00:06:56,490 --> 00:06:59,310 to bury their attacks within the network noise. 219 219 00:06:59,310 --> 00:07:02,370 For instance, one of my last organizations I worked at 220 220 00:07:02,370 --> 00:07:03,870 had about a million endpoints. 221 221 00:07:03,870 --> 00:07:06,510 That's a million different computers on our network. 222 222 00:07:06,510 --> 00:07:07,710 That is a lot of noise 223 223 00:07:07,710 --> 00:07:10,170 and a lot of data inside of our SIEMs. 224 224 00:07:10,170 --> 00:07:12,780 And so if somebody went and did one bad thing 225 225 00:07:12,780 --> 00:07:15,120 one time today and then didn't do anything bad again 226 226 00:07:15,120 --> 00:07:16,380 for three months from now, 227 227 00:07:16,380 --> 00:07:18,180 it's going to be hard for us to see that. 228 228 00:07:18,180 --> 00:07:19,980 Whereas if they're doing a bunch of things today, 229 229 00:07:19,980 --> 00:07:21,180 we would probably catch it. 230 230 00:07:21,180 --> 00:07:24,150 And so it's a matter of how much they're doing at one time. 231 231 00:07:24,150 --> 00:07:27,240 And so if attackers can take their time and be patient, 232 232 00:07:27,240 --> 00:07:29,970 they can do one thing today, one thing next week, 233 233 00:07:29,970 --> 00:07:31,500 one thing in three weeks from now, 234 234 00:07:31,500 --> 00:07:34,110 and bury themself inside the noise of the network. 235 235 00:07:34,110 --> 00:07:36,690 Now, the reason these sparse attacks work for an attacker 236 236 00:07:36,690 --> 00:07:40,080 is because a lot of times we will end up tuning down 237 237 00:07:40,080 --> 00:07:41,730 the sensitivity of our systems 238 238 00:07:41,730 --> 00:07:43,920 because we get so many false positives. 239 239 00:07:43,920 --> 00:07:44,753 Let's take for example 240 240 00:07:44,753 --> 00:07:46,800 somebody trying to guess your password. 241 241 00:07:46,800 --> 00:07:49,680 Now, if I log in today with one password and it didn't work, 242 242 00:07:49,680 --> 00:07:51,780 and I try again tomorrow and it didn't work, 243 243 00:07:51,780 --> 00:07:53,670 and I try again the next day and it didn't work, 244 244 00:07:53,670 --> 00:07:54,900 and I do that every single day, 245 245 00:07:54,900 --> 00:07:57,120 and I only try one time each day, 246 246 00:07:57,120 --> 00:07:58,500 would you catch that? 247 247 00:07:58,500 --> 00:08:00,720 Most likely not because most systems 248 248 00:08:00,720 --> 00:08:03,660 are tuned to only catch three failed login attempts 249 249 00:08:03,660 --> 00:08:05,220 within 30 minutes 250 250 00:08:05,220 --> 00:08:07,890 or three failed login attempts within one hour. 251 251 00:08:07,890 --> 00:08:09,840 And so if I do one per day 252 252 00:08:09,840 --> 00:08:12,360 for the next six months until I guess your password, 253 253 00:08:12,360 --> 00:08:14,070 I'll probably get there eventually. 254 254 00:08:14,070 --> 00:08:17,070 That's the idea here when we talk about a sparse attack. 255 255 00:08:17,070 --> 00:08:19,800 Now, even though that sparse attack wouldn't be caught 256 256 00:08:19,800 --> 00:08:21,150 based on my login attempts, 257 257 00:08:21,150 --> 00:08:23,250 if I finally did guess your password 258 258 00:08:23,250 --> 00:08:25,590 and I start downloading all your files, 259 259 00:08:25,590 --> 00:08:27,870 trend analysis may help you catch me. 260 260 00:08:27,870 --> 00:08:29,490 Because as I'm downloading all that stuff, 261 261 00:08:29,490 --> 00:08:31,230 now your system which is normally used 262 262 00:08:31,230 --> 00:08:33,510 to downloading maybe a hundred megabytes per day 263 263 00:08:33,510 --> 00:08:35,580 is downloading a gigabyte per day. 264 264 00:08:35,580 --> 00:08:37,110 That would be something that could identify it 265 265 00:08:37,110 --> 00:08:39,600 using trend analysis to identify this sparse attack 266 266 00:08:39,600 --> 00:08:41,220 that was successful. 267 267 00:08:41,220 --> 00:08:42,600 Now, the last thing we need to mention 268 268 00:08:42,600 --> 00:08:44,460 in this discussion of trend analysis 269 269 00:08:44,460 --> 00:08:47,340 is narrative-based threat awareness and intelligence. 270 270 00:08:47,340 --> 00:08:49,050 Now, this is a form of trend analysis 271 271 00:08:49,050 --> 00:08:51,240 that's reported in longform prose 272 272 00:08:51,240 --> 00:08:53,940 to describe a common attack vector seen over time. 273 273 00:08:53,940 --> 00:08:57,990 For example, over time, we started seeing that bad people 274 274 00:08:57,990 --> 00:08:59,700 were using internet relay chat 275 275 00:08:59,700 --> 00:09:02,850 as a way to do commanding control of their botnets. 276 276 00:09:02,850 --> 00:09:04,770 Over time, security reachers kept seeing this. 277 277 00:09:04,770 --> 00:09:05,910 They analyzed the trends 278 278 00:09:05,910 --> 00:09:07,230 and they wrote a report on this 279 279 00:09:07,230 --> 00:09:09,547 known as a narrative-based threat assessment that said, 280 280 00:09:09,547 --> 00:09:12,090 "Hey. Internet Relay Chat is being used 281 281 00:09:12,090 --> 00:09:13,110 as commanding control. 282 282 00:09:13,110 --> 00:09:16,230 So if you don't need IRC inside your organization, 283 283 00:09:16,230 --> 00:09:17,370 you should block it." 284 284 00:09:17,370 --> 00:09:19,230 And so a lot of people blocked it, the firewall. 285 285 00:09:19,230 --> 00:09:21,840 Well, because of that, attackers saw that it was blocked 286 286 00:09:21,840 --> 00:09:23,760 and they ended up switching to another mechanism 287 287 00:09:23,760 --> 00:09:27,540 which is using SSL tunnels over https. 288 288 00:09:27,540 --> 00:09:30,300 That way they can blend in with the rest of the network. 289 289 00:09:30,300 --> 00:09:33,180 Again, this is just an example of over time 290 290 00:09:33,180 --> 00:09:35,370 how you can see lots of these little events 291 291 00:09:35,370 --> 00:09:36,997 and then you put them together as a trend and say, 292 292 00:09:36,997 --> 00:09:38,190 "This is a trend." 293 293 00:09:38,190 --> 00:09:41,460 Bad guys, bad people are using this as a C2 mechanism 294 294 00:09:41,460 --> 00:09:43,080 so therefore we should block it. 295 295 00:09:43,080 --> 00:09:44,520 Now once they moved and changed, 296 296 00:09:44,520 --> 00:09:46,260 now we have to move and change with them 297 297 00:09:46,260 --> 00:09:49,650 and we need to identify what is real is https traffic 298 298 00:09:49,650 --> 00:09:52,050 and what is malicious command and control bots 299 299 00:09:52,050 --> 00:09:53,070 that are using that 300 300 00:09:53,070 --> 00:09:54,660 and be able to separate those things out. 301 301 00:09:54,660 --> 00:09:56,960 And again, trend analysis can help us do that.