Lecturer: In this lesson, we will learn about
behavior baselines and analytics.
Behavior baselines and analytics are used to establish
normal patterns of activity for networks, systems, users,
and applications.
Only after understanding normal patterns can anomalies
that indicate security threats be recognized.
Behavior baselines and analytic concepts
include network, systems, users, as well as applications
and services' behavior baselines.
Network behavior baselines track typical traffic patterns
to identify unusual data flows or connections.
System baselines monitor regular system resource usage
such as CPU or memory to detect unexpected anomalies.
User behavior analytics identify deviations from normal user
actions, such as unusual login times
or access to sensitive data.
Finally, application and service baselines help detect
anomalies in service usage or response times.
Let's learn more about network systems, users
as well as applications and services behavior baselines.
First, we have network baselines.
A network behavior baseline refers to the typical patterns
of data traffic on a network, including the amount
and types of data flowing, common connections,
and the usual times for high or low network activity.
Establishing a network baseline involves monitoring network
traffic over time to understand what is normal.
This might include looking at data transfer rates,
common protocols used, and frequent sources
and destinations of traffic.
On a day-to-day basis, security tools such as Snort
and Suricata may continuously monitor the network,
comparing real-time traffic against this baseline
to detect any deviations.
In this example, Snort is an example
of an intrusion detection system while Suricata can operate
both as an intrusion detection system
and intrusion prevention system,
actively monitoring network traffic
and identifying unusual patterns.
At any rate, by analyzing network baselines,
unusual behaviors such as a sudden surge in traffic
or unexpected external connections can be detected.
For instance, if a sudden spike in data is being sent
to an unknown external IP address,
this could indicate a potential data exfiltration attempt
or malware trying to communicate with a command
and control server.
A significant increase in network traffic may also
point to a distributed denial of service attack
requiring immediate action.
Second, we have system baselines.
A system baseline tracks the normal usage
of system resources such as CPU and memory
and disc input and output.
A system baseline reflects what regular system performance
looks like under typical workloads.
Establishing this baseline requires monitoring
resource metrics over time
and gathering data to determine
what resource usage looks like during routine operations.
Tools such as Windows PerfMon can be used
to create system baselines
by collecting performance metrics over time.
Then, daily monitoring tools such as Datadog
and Prometheus can be used
to continuously compare real-time resource usage
against the baseline, flagging any unexpected changes
that could indicate a problem, such as a sudden spike in CPU
usage or memory consumption.
Now, once a system baseline is established,
deviations can signal potential issues.
For example, if a server's CPU usage suddenly spikes
to 100% without reason, this could indicate malware
running on the system or something consuming
excessive resources, or a sustained high memory usage
might suggest a memory leak in an application,
which could eventually lead to a system crash
if not addressed.
So detecting anomalies early helps administrators respond
before they escalate into bigger problems.
Third, we have user baselines.
User behavior, baselines capture normal user activities,
such as typical login times, access to specific files
or systems, and the devices users log in from.
Establishing a baseline
for user behavior involves observing
and recording these daily habits for each user.
By doing so, the system learns
what constitutes regular behavior.
Tools like Splunk User Behavior Analytics can help establish
these baselines by tracking and analyzing user activities
over time.
Monitoring can then be conducted
to analyze realtime user activities against pre-established
patterns, detecting any deviations
that may indicate suspicious behavior or security threats.
So once a user baseline is set,
it becomes much easier to detect anomalies
that could indicate a security threat.
For example, if a user who normally logs in
during business hours from a desktop suddenly logs in late
at night from a foreign IP address, it could be a sign
that the user's credentials have been compromised.
Similarly, if a user starts accessing sensitive files
or systems they don't typically interact with,
it may suggest an insider threat or a compromised account.
Fourth and last, we have application and service baselines.
Application and service baselines establish
what typical usage patterns and performance metrics
look like for the applications and services
running in an environment.
These baselines might include normal response times,
the number of active users, typical error rates,
and the resources consumed by the application
under normal operations.
These patterns are gathered over time
to create a reliable baseline.
Then monitoring tools continuously compare current
performance against these standards.
Tools like AppDynamics can be used to establish
and monitor these baselines
by tracking application performance metrics over time,
helping to identify anomalies and potential issues
before they impact users.
So when an application
or a service deviates from its established baseline,
it could signal an underlying issue.
For instance, if an application
that normally processes a certain number of transactions
per hour suddenly experiences a significant slowdown
or increased error rate, it might indicate
performance issues or even a security breach,
like a denial of service attack.
Similarly, a service consuming significantly more resources
than usual may suggest malware is exploiting vulnerabilities
within that service, requiring immediate investigation.
So remember, behavior baselines and analytics are essential
for establishing normal patterns of activity
across networks, systems, users, and applications.
Once normal patterns are understood,
anomalies indicating potential security threats
can be detected.
Next, network baselines help track typical traffic patterns
and connections while system baselines monitor regular
resource usage like CPU and memory.
Then user behavior baselines focus on capturing normal
activities such as login times and file access,
allowing unusual behavior to be identified.
Finally, application and service baselines track usage
and performance metrics, helping detect deviations
in response times or resource consumption.
In the end, monitoring baselines consistently helps security
teams quickly spot potential threats
or performance issues across the enterprise environment.