Behavior monitoring
Behavior monitoring
Behavior monitoring definition
Behavior monitoring refers to a proactive approach to detecting threats by analyzing the behavior of users, applications, and systems to identify abnormal patterns that could indicate a potential security incident. Since it looks for any activity that deviates from an established pattern, it doesn’t have to rely solely on signature-based detection methods which can often miss unknown threats.
See also: application performance monitoring, network traffic analysis
How does behavior monitoring work
Behavior monitoring systems typically work by establishing a baseline of normal behavior first. For example, it can analyze the regular patterns of users and system components over a period of time to understand what’s normal for each user or system. On one hand, taking data from a longer period of time makes establishing the baseline behavior easier but it is also important to understand the context within that behavior.
Once the baseline is established, the system must monitor all the activities and look for abnormalities by comparing it to the baseline.
Once the baseline is established, the system must monitor all the activities and look for abnormalities by comparing it to the baseline.
Where is behavior monitoring useful:
- Insider threat detection. It can help detect threats from inside the organization such as if an employee starts accessing files they don’t need for their job.
- Advanced persistent threat (APT) detection. Monitoring behavior can help recognize APTs, long-term attacks where hackers gain access to a network and remain undetected for a long period.
- Detecting compromised accounts. If an attacker gains control of a legitimate user’s account, they can often bypass traditional security defenses. Behavior monitoring could detect unusual behavior and prevent the attacker from doing damage.
- Zero-day attack detection. While zero-day attacks can’t be detected with traditional means because they exploit unknown vulnerabilities, behavior monitoring could recognize these attacks.
