By Antonios Mpantis*
Behavioral anomaly detection is one of the key pieces of next generation AI cybersecurity that enables systems to recognize activity patterns that don’t align with normal expected activity. Those AI models, rather than just depending and trained on datasets that describe pre-defined attack signatures, they are learning and define a baseline of normal activity, using datasets that describe the everyday network activities, and calls out anomalies that may be suspicious activity.
For network security, it can be seen as the detection of abnormal login hours, abnormal amounts of data transmission, abnormal incoming or outgoing traffic from services, or incorrect access attempts. For instance, if a user initiates a session after office hours from an unfamiliar location, the model would flag it as abnormal. Similarly, if a service generates a traffic stream that deviates from typical patterns, it would be identified as an anomaly.
The rNAD (Behavioral Network Anomaly Detection tool by ATC) is designed to ensure that devices operate consistently with the behavioral baseline defined by the dataset. If unexpected behavior occurs, such as after a device module update or the replacement of a device with one that behaves differently, the model flags it as an anomaly. For example, if the dataset specifies that a device or devices in a network, should not send traffic to destinations outside the EU, or that traffic packets must adhere to a defined structure, any deviation from these rules would be recognized as abnormal.
One of the drawbacks of behavior anomaly detection systems is that they will at times generate false positives. Going back to the previous examples, a user that initiates a session after working hours, will be flagged by the tool as an anomaly. Initiating a session after working hours it cannot be considered as a malicious action by its nature, it needs to be evaluated further to reach in such conclusion or a sudden packet exchange of service could be a urgent update and not a compromised service. Despite those drawbacks, behavioral anomaly detection is one of the few methods that does a good job of spotting zero-day exploits. Because it does not depend on pre-knowledge of attacks, it is very appropriate to detect activity that is unknown-threats or activity that isn’t categorized as malicious.
The rNAD also identifies the above type of behavior anomalies and has been further enhanced to provide the root cause analysis of the anomaly. The root cause analysis is the factor which categorizes a traffic stream as an anomaly stream. These parameters are attributes of the network stream such as destination IP, source IP, port, level of traffic, etc. This type of information becomes informative to the security engineer to determine if the action is of malicious type or a false positive.
Its future development will be focusing on making the system more robust by reducing false positives and increasing robustness overall. Prospective improvements include the addition of more models with which to analyze packets and the addition of respective methods such as signature-based identification.
*Antonis Mpantis, MEng in Informatics and Telecommunications Engineering, Software Architect and software systems specialist, works at Athens Technology Center, with professional focus on building secure and scaleable solutions for the areas of AI, Cybersecurity, and IoT, particularly software architecture, DevSecOps practices, and risk analysis.