Overview
Network anomalies are deviations from normal traffic that can reveal attacks signatures miss. This lesson covers anomaly-based detection.
Learning objectives
- Explain network anomaly detection.
- Give examples of suspicious network anomalies.
- Connect anomalies to detecting unknown threats.
Core concept
Network anomalies are deviations from a baseline of normal network behavior — the basis of anomaly-based detection, which catches threats without a specific signature (novel attacks, unusual behavior). Examples of suspicious anomalies: unusual traffic volumes (a host sending far more data than normal — possible exfiltration), connections to unexpected destinations or on unusual ports/protocols, beaconing (regular, periodic connections characteristic of C2), scanning patterns (one host touching many hosts/ports), and off-hours or otherwise atypical activity. Anomaly detection requires an accurate baseline (module 3) of what's normal, and produces more false positives than signatures (normal-but-unusual activity), so anomalies are leads validated with context. Its value is catching the unknown — attacks and behaviors that no signature describes.
How it works
Anomaly-based detection compares observed traffic to a baseline of normal behavior (built from historical patterns — module 3) and flags significant deviations. Suspicious anomalies include: a host's outbound volume spiking (possible data exfiltration), connections to new/unexpected external destinations or unusual ports/protocols (possible C2 or tunneling), beaconing — regular, periodic small connections at consistent intervals (a hallmark of malware C2 check-ins), scanning/sweeping behavior (one source contacting many destinations/ports — reconnaissance or lateral movement), and unusual protocol usage. Because "unusual" isn't always "malicious," anomaly detection generates more false positives than signatures, so each anomaly is a lead requiring context and validation (is there a benign reason? does it correlate with other signals?). Its strength is detecting the unknown — novel attacks, zero-days, and unusual attacker behavior that signatures can't describe — complementing signature detection. Baseline quality is crucial: a poor baseline yields noise or misses. Anomaly detection embodies the anomaly-based approach from module 3 applied to network traffic, and feeds validated leads into triage and correlation.
Practical example
The IDS's anomaly detection flags an internal host exhibiting beaconing — small, regular, periodic connections to an external address every few minutes, deviating from the host's normal pattern. No signature matched (the C2 is unknown), but the periodic regularity is a classic C2 hallmark. Separately, it flags a host with a sudden large outbound volume to an unfamiliar destination (possible exfiltration). Both are anomalies, not signature hits — so the analyst validates each with context (benign explanation? correlated with other signals?). The beaconing, corroborated, reveals likely C2 that signature detection missed — showing anomaly detection's value against unknown threats.
Cybersecurity relevance
Anomaly-based network detection catches what signatures miss — novel attacks, zero-days, and unusual attacker behavior with no signature — by flagging deviations from a baseline (module 3): volume spikes (exfiltration), unexpected destinations/ports, beaconing (C2 hallmark), and scanning (recon/lateral movement). It's the network complement to signature detection (defense in depth), but produces more false positives (unusual ≠ malicious), so anomalies are leads requiring context and validation (next lesson). Baseline quality is crucial. This applies the anomaly-detection approach to traffic and connects to flow analysis and correlation — extending the SOC's ability to detect unknown network threats beyond known-signature matching.
Common mistakes
- Treating anomalies as confirmed threats without validation (they carry more false positives).
- Poor baselines, causing excessive noise or missed anomalies.
- Missing beaconing/scanning patterns by not looking for regularity or fan-out.
Key takeaways
- Network anomalies are deviations from a normal-traffic baseline — the basis of anomaly detection, which catches threats without a signature (novel attacks, unusual behavior).
- Suspicious examples: volume spikes (exfiltration), unexpected destinations/ports, beaconing (C2 hallmark), scanning (recon/lateral movement).
- Anomaly detection catches the unknown (complementing signatures) but has more false positives, so anomalies are leads requiring context and validation; baseline quality is crucial.
Check your understanding
- What are examples of suspicious network anomalies, and what might each indicate?
- Why does anomaly detection catch unknown threats but produce more false positives than signatures?