Behavior-based analysis involves using baseline information to detect what?
|
To fully unleash behavioral analysis, companies must take advantage of the cloud and its immense computational power, unlimited scalability, and ease of management. The cloud provides a proactive approach that combines big data with powerful analytics to help outsmart the latest, most threatening emerging attacks. For example, the cloud enables streaming analytics, where normal and abnormal endpoint activity can be monitored and compared to any unfiltered historical endpoint data. By analyzing these event streams and comparing them to what looks like normal ones, the cloud creates a global threat monitoring system that not only detects attacks, but predicts ones that have never been seen before. This powerful approach is simply not possible with traditional AV solutions, which are signature-based, but it is with next-generation antivirus (NGAV) software. NGAV in the cloud offers bi-directional communication with endpoints, so that all unfiltered endpoint data can be monitored and turned into predictive analytics that proactively protects companies from sophisticated attacks. Plus, the cloud provides the infrastructure benefits that most companies are already experiencing with other enterprise software – simplified, less costly operations, faster deployment, and the latest and most innovative technology. Behavior-based security is a proactive approach to security in which all relevant activity is monitored so that deviations from normal behavior patterns can be identified and dealt with quickly. As machine learning continues to improve, this approach to security management is expected to play an important role in securing computing at the edge of the network. Traditional security software is signature-oriented: the software monitors data streams and compares data in transit to signatures in an anti-virus vendor's library of known threats. Behavior-based security programs work a little differently -- they monitor data streams too, but then they compare data stream activity to a baseline of normal behavior and look for anomalies. Behavior-based security products use applied mathematics and machine learning to flag events that are statistically significant. While there may still be instances where an organization needs to choose between signature-based and anomaly-based security software, there is a broad range of intrusion detection and prevention products that combine both approaches. Advantages of behavior-based securityIn general, signature-based tools are best at identifying and repelling known threats, while behavior-based are best for fighting zero-day exploits that have not yet made it onto a list of known threat signatures. Most behavior-based security programs come with a standard set of policies for which behaviors should be allowed and which should be considered suspicious, but also allow administrators to customize policies and create new policies. Behavior-based security softwareDepending upon its capabilities, a behavior-based security software product may be marketed as a network behavior anomaly detection (NBAD) product, a behavior-based intrusion detection product, a behavior threat analysis (BTA) product or a user behavior analytics (UBA) product. Some behavior-security products are sophisticated enough to apply machine learning algorithms to data streams so that security analysts don't need to identify what comprises normal behavior. Other products include behavioral biometrics features that are capable of mapping specific behavior, such as typing patterns, to specific user behavior. Most products have sophisticated correlation engines to minimize the number of alerts and false positives. This was last updated in January 2020 Continue Reading About behavior-based security
Related TermschecksumA checksum is a value that represents the number of bits in a transmission message and is used by IT professionals to detect ... See complete definitionEvil CorpEvil Corp is an international cybercrime network that uses malicious software to steal money from victims' bank accounts and to ... See complete definitionGPS jammingGPS jamming is the act of using a frequency transmitting device to block or interfere with radio communications. See complete definitionWord of the Day adversarial MLAdversarial machine learning is a technique used in machine learning to fool or misguide a model with malicious input. |
