Exception-based detection technology

In the zero-day detection, we use exception-based monitoring to introduce two basic exception-based detection technologies and a variety of exception analysis models. Finally, we mention the exception. I think there are several specific translations in the translation. If you are interested, you can look at the original article.

These two basic anomaly detection technologies are called heuristic method and the policy profile method. I translate them into heuristic and policy profile methods.

In my understanding, it actually refers to dynamic baselines and indicator baselines.

Dynamic baselines have been widely used in traffic exception detection, including periodic and non-periodic baselines. non-periodic baselines are also called predictive baselines. We have used this technology in the security management platform. by modeling the traffic data, we have created a Behavior Profile for key analysis objects (such as source/destination IP addresses ), the actual traffic is analyzed by year-on-year comparison and period-over-period comparison to determine possible exceptions. This technology is particularly effective in detecting DoS attacks, as well as sudden changes in small traffic (such as information leakage in APT attacks ). Creating a behavior profile is actually a machine learning process. In addition, this part is too much to elaborate, and I will explain it in more detail in the future.

Configure a baseline is the easiest thing to think. However, the baseline range covered by the exception detection based on the indicator baseline is larger than that of the configuration item. There is a GCC thing internationally [not gnu c Compiler]. You can check it out. The indicator baseline is to select key indicators from the safe operation/status parameters that characterize an object or environment, set the baseline of these indicators, and then compare it with the tested environment/object to find the exception. For example, a host can/cannot run certain processes and opens some ports, which is relatively simple. It is also complicated to model indicators of objects/environments, or even automated dynamic modeling. Many sandbox technologies/0-day malicious code detection technologies use this method.