Instructor: Trend Analysis. 2 2
In this lesson, we are going to talk all about trend analysis. 3 3
Now, trend analysis is the process of detecting patterns 4 4
within a dataset over time 5 5
and using those patterns to make predictions 6 6
about future events or better understand our past events. 7 7
Now, the whole idea here with trend analysis 8 8
is we should understand what a baseline looks like. 9 9
What does our system normally look like? 10 10
And then, what goes outside that trend? 11 11
If that trend starts going up or down 12 12
or goes way off to the side, 13 13
that is something that we want to know 14 14
because it might mean that either an attack is coming 15 15
because it's trending upward, or something already happened 16 16
and that's why we see this big spike. 17 17
Now, when we deal with trend analysis, 18 18
this can enable us to review past events 19 19
from a new perspective as well. 20 20
For instance, if I look back over my logs 21 21
for the last six months and I see 22 22
there was a big spike back in, say, three months ago, 23 23
I can then go back three months 24 24
and start investigating that. 25 25
Now, by going back and looking at that event 26 26
over this time period, we can see where those patterns are, 27 27
and we can identify what goes outside the pattern. 28 28
This is really important because it is really impossible 29 29
to identify a trend when you're just looking 30 30
at a single logged event. 31 31
For instance, back in elementary school 32 32
when you learned how to graph things 33 33
on a piece of graph paper, 34 34
you would go and put a single dot. 35 35
And you wouldn't really know what that really meant. 36 36
But if you put a second dot 37 37
and then a third dot and a fourth dot, 38 38
you could start seeing where those trends go over time. 39 39
And that trend is really important 40 40
because it starts to tell you a lot more 41 41
than any single event could on its own. 42 42
Now, when we deal with trend analysis, 43 43
there is three different kinds that we can deal with. 44 44
We have frequency-based trend analysis, 45 45
volume-based trend analysis, 46 46
and statistical deviation trend analysis. 47 47
Let's talk about each of those as we go through this lesson. 48 48
First, we have frequency-based analysis. 49 49
Now, when we deal with frequency-based analysis, 50 50
this is going to establish a baseline for a given metric 51 51
and then monitor the number of times 52 52
that occurrence happens over a given period of time. 53 53
For example, here on the screen, 54 54
you can see the notable events over time. 55 55
And you can see how the count goes up and down 56 56
over a given period of time 57 57
based on what the different events are. 58 58
For instance, I can see there's a big spike on access 59 59
at around 7 PM at night 60 60
and then again around 7:00 to 8:00 in the morning. 61 61
Those are times, probably, when there was a shift change 62 62
between two different analysts, 63 63
and so somebody had to log on 64 64
when all the new shift came on and all the shift went off. 65 65
That was the idea there. 66 66
We can also see a couple of spikes around 9 AM 67 67
on the right side of the chart. 68 68
There I see there's a red one and a yellow one. 69 69
The red indicates endpoint. 70 70
And then shortly after that, 71 71
we see an increase in the threat as well. 72 72
This shows us that the endpoints were logging something 73 73
and shortly after, we started seeing threats rise as well. 74 74
And so, we start having additional information 75 75
that we can start putting all that together 76 76
as part of our frequency-based analysis. 77 77
The next one we want to talk about is volume-based analysis. 78 78
Now, volume-based analysis is going to measure a metric 79 79
based on the size of something, 80 80
such as how much disk space is being used 81 81
or the log file size that's being used 82 82
or something like that. 83 83
For example, let's take a look 84 84
at our database server network utilization. 85 85
Last week it was 40 megabytes. 86 86
This week it was 800 megabytes. 87 87
That is a 20 time increase. 88 88
Now is that good or is that bad? 89 89
Well, it could be good, it could be bad. 90 90
We really don't know. 91 91
But it is something that we should identify. 92 92
This is a unique thing. 93 93
It's an anomaly that goes outside of our trend 94 94
based on our usual volume. 95 95
Now, if I had multiple weeks to look at this, 96 96
I could say it's usually around 30 to 40 to 50 megabytes. 97 97
This week it jumped up to 800. 98 98
Well, that's something I want to look into 99 99
because maybe I'm the victim of a data exfiltration 100 100
and they're dumping my entire database 101 101
over to their servers. 102 102
And that would show a huge volume of network utilization 103 103
and so we'd want to look into that. 104 104
That's where volume-based can really help you out. 105 105
The third type we have is statistical deviation analysis. 106 106
Now, this is going to use the concept of mean 107 107
and standard deviations to determine 108 108
if a data point should be treated as suspicious. 109 109
Now, this is a math term when you talk about mean. 110 110
Mean is basically the average. 111 111
It's the sum of all the values 112 112
divided by the number of samples. 113 113
So for example, on this chart you can see the blue line. 114 114
That's the mean. 115 115
We expect a one-to-one or a two-to-two correlation 116 116
as we go up the line. 117 117
Now, if we have something that goes far outside of that, 118 118
for example the green dot which is showing at 4.5 119 119
and one going upward, 120 120
this is something that is way outside the norm. 121 121
Now, what does this graph represent? 122 122
Well, nothing really, it's just an example. 123 123
But it could represent lots of different things. 124 124
For example, what if these data points were showing us 125 125
the relationship between the standard users 126 126
and the privilege users, 127 127
and how many times they're invoking a process 128 128
and how they're running it? 129 129
For instance, if I have one user account 130 130
but I'm logging into 4 1/2 different systems, 131 131
that would be unusual. 132 132
If I had one user account 133 133
and I'm logging into one system, that would be normal. 134 134
The example on the screen here 135 135
doesn't really matter what those axises are. 136 136
It just showing you the concept. 137 137
When we start seeing something 138 138
that is outside the standard mean or outside the average 139 139
that is when we're going to flag on it 140 140
and that's called a statistical deviation analysis. 141 141
Now, one thing to keep in mind 142 142
when you're dealing with trend analysis is 143 143
that your trend analysis is going to be very dependent 144 144
on what metrics are used 145 145
for your baseline and your measurement. 146 146
If you're not measuring the right things, 147 147
you can miss bad things that are happening. 148 148
If you're measuring the right things, 149 149
but you don't watch those things over time, 150 150
you can miss things as well. 151 151
So you have to make sure you pick exactly 152 152
what you want to measure. 153 153
And, given the resources you have, 154 154
which ones you're going to actually look at 155 155
and analyze using your analyst 156 156
because you only have so many people and only so much time. 157 157
So when it comes to trend analysis, 158 158
you have to figure out what you're going to measure. 159 159
And, there's lots of things you could measure. 160 160
You could measure the number of alerts 161 161
and the number of incidents 162 162
and see how these trend over time. 163 163
You might look at the time to respond 164 164
and how quickly is this going up or down? 165 165
Are you getting better at doing responses? 166 166
How about the number of network 167 167
or host metrics that there are? 168 168
You might be looking at network bandwidth. 169 169
You might be looking at volume of storage. 170 170
You might be looking at log files. 171 171
You might be looking at number of log-ons. 172 172
You might look at number of active ports. 173 173
There's tons of different metrics you can choose from. 174 174
You might also look at training and education 175 175
and we've talked about this before. 176 176
How well informed is your staff in regards to cyber threats? 177 177
Do they know what phishing emails look like? 178 178
How many times have you given these programs in a year? 179 179
How many people have gone through? 180 180
How have they done their grade assessments? 181 181
Have you done pen tests to see 182 182
if they fall for these type of tricks? 183 183
How about compliance? 184 184
How well are your systems complying to your baseline? 185 185
Are they all patched? 186 186
Are they all scanned? 187 187
Are they all have up to date antivirus? 188 188
How many of them are up? 189 189
How many of them are down? 190 190
All of this is data you could be looking at. 191 191
And then finally, how about your external threat levels? 192 192
What is the external threat level look like 193 193
right now in the world? 194 194
As you keep reading about different cyber threats 195 195
that are out there, 196 196
do they apply to you? 197 197
Are they all going after Window systems, 198 198
but you're using Linux? 199 199
Or, are you using Linux 200 200
and they're going after Linux systems? 201 201
Are you in an industry right now 202 202
that everybody seems to be attacking? 203 203
For instance, maybe you work for a credit card processor 204 204
or a bank and you see that this industry 205 205
has been targeted week after week, 206 206
month after month, year after year. 207 207
Or maybe you work for a software company 208 208
and you realize nobody's really going after them 209 209
so you're not as worried. 210 210
That external threat level does make a difference 211 211
and you have to keep that in mind too. 212 212
Now, one other thing I want to talk about 213 213
when we talk about trend analysis is 214 214
that trend analysis can help you figure out 215 215
if you're being the victim of a sparse attack. 216 216
Now, what is a sparse attack? 217 217
Well, sometimes attackers will use a sparse attack technique 218 218
to bury their attacks within the network noise. 219 219
For instance, one of my last organizations I worked at 220 220
had about a million endpoints. 221 221
That's a million different computers on our network. 222 222
That is a lot of noise 223 223
and a lot of data inside of our SIEMs. 224 224
And so if somebody went and did one bad thing 225 225
one time today and then didn't do anything bad again 226 226
for three months from now, 227 227
it's going to be hard for us to see that. 228 228
Whereas if they're doing a bunch of things today, 229 229
we would probably catch it. 230 230
And so it's a matter of how much they're doing at one time. 231 231
And so if attackers can take their time and be patient, 232 232
they can do one thing today, one thing next week, 233 233
one thing in three weeks from now, 234 234
and bury themself inside the noise of the network. 235 235
Now, the reason these sparse attacks work for an attacker 236 236
is because a lot of times we will end up tuning down 237 237
the sensitivity of our systems 238 238
because we get so many false positives. 239 239
Let's take for example 240 240
somebody trying to guess your password. 241 241
Now, if I log in today with one password and it didn't work, 242 242
and I try again tomorrow and it didn't work, 243 243
and I try again the next day and it didn't work, 244 244
and I do that every single day, 245 245
and I only try one time each day, 246 246
would you catch that? 247 247
Most likely not because most systems 248 248
are tuned to only catch three failed login attempts 249 249
within 30 minutes 250 250
or three failed login attempts within one hour. 251 251
And so if I do one per day 252 252
for the next six months until I guess your password, 253 253
I'll probably get there eventually. 254 254
That's the idea here when we talk about a sparse attack. 255 255
Now, even though that sparse attack wouldn't be caught 256 256
based on my login attempts, 257 257
if I finally did guess your password 258 258
and I start downloading all your files, 259 259
trend analysis may help you catch me. 260 260
Because as I'm downloading all that stuff, 261 261
now your system which is normally used 262 262
to downloading maybe a hundred megabytes per day 263 263
is downloading a gigabyte per day. 264 264
That would be something that could identify it 265 265
using trend analysis to identify this sparse attack 266 266
that was successful. 267 267
Now, the last thing we need to mention 268 268
in this discussion of trend analysis 269 269
is narrative-based threat awareness and intelligence. 270 270
Now, this is a form of trend analysis 271 271
that's reported in longform prose 272 272
to describe a common attack vector seen over time. 273 273
For example, over time, we started seeing that bad people 274 274
were using internet relay chat 275 275
as a way to do commanding control of their botnets. 276 276
Over time, security reachers kept seeing this. 277 277
They analyzed the trends 278 278
and they wrote a report on this 279 279
known as a narrative-based threat assessment that said, 280 280
"Hey. Internet Relay Chat is being used 281 281
as commanding control. 282 282
So if you don't need IRC inside your organization, 283 283
you should block it." 284 284
And so a lot of people blocked it, the firewall. 285 285
Well, because of that, attackers saw that it was blocked 286 286
and they ended up switching to another mechanism 287 287
which is using SSL tunnels over https. 288 288
That way they can blend in with the rest of the network. 289 289
Again, this is just an example of over time 290 290
how you can see lots of these little events 291 291
and then you put them together as a trend and say, 292 292
"This is a trend." 293 293
Bad guys, bad people are using this as a C2 mechanism 294 294
so therefore we should block it. 295 295
Now once they moved and changed, 296 296
now we have to move and change with them 297 297
and we need to identify what is real is https traffic 298 298
and what is malicious command and control bots 299 299
that are using that 300 300
and be able to separate those things out. 301 301
And again, trend analysis can help us do that.