Anomaly detection is a variety of unsupervised machine learning that aims to identify deviations from past behavior. For organizations, anomalies come in many forms – there are frequent anomalies such as employees going on vacation, and large anomalies such as the COVID-19 pandemic where suddenly the entire workforce is working remotely. Tailoring anomaly detection models to a specific use case allows organizations to find only the anomalies that are relevant for cybersecurity.
Anomaly detection is particularly useful in endpoint and user behavioral analytics. Unsupervised learning algorithms model the normal behavior of endpoints and users, enabling identification of anomalous activity that is likely malicious. This is helpful in identifying unknown threats because the anomaly detection models are not reliant on known examples of attacks.
Supervised modeling is another form of machine learning commonly used in cyber analytics. Whereas a traditional approach to cybersecurity might involve asking a cybersecurity expert for heuristics to identify threats, supervised detection systems use large datasets to learn threat features and characteristics in a principled mathematical approach, enabling organizations to better distinguish between benign and malicious activity.
While a supervised modeling approach allows precise detections of specific types of cyber threats, it does require threat information to be available for model training and can be less effective in cases where threats are unknown. Supervised detection and unsupervised anomaly detection approaches therefore complement each other in forming complete detection coverage for an organization.
In security parlance, the detection outputs of both unsupervised and supervised models are referred to as spot detections. Spot detections provide information around a single unit of analysis, such as a specific authentication action or executable. Spot detections are useful for making predictions, but they don’t tell the whole story. Detection correlations, on the other hand, allow security experts to combine multiple spot detections to form the complete picture of an attack across an enterprise.
Consider this example: if you’re just analyzing an individual firewall rule, you might think a certain activity was blocked for benign reasons. But with correlation analysis, you can see there was a sequence of related activities that started with an anomalous authentication, followed by the transfer of a file to a remote machine and then the execution of a malicious file. Here, the ability to detect a correlation exposes malicious activity you may have otherwise missed.
Collective Defense is a collaborative approach to cybersecurity that extends correlation detection beyond the enterprise. Organizations that participate in a collective defense system can see attack trends or sequences of events across their industry, enabling a more proactive defense. By analyzing common techniques based on real-world observations, as mapped within the MITRE ATT&CKⓇ Framework, you can start to assess where you need to shore up your defenses.
.png)
