In this episode,
we're going to talk about pattern recognition and why it's important
for you as a cybersecurity analyst to use pattern recognition.
Most times people look at cybersecurity is
purely a logical scheme for scientific measures,
but that's not necessarily true.
Cybersecurity is part of tuition and part logic to form a
uh
analytical point of view that points to a specific
problem or a series of problems within your network.
Pattern recognition is the process of identifying
recurring patterns or anomalies within your network.
That means to say that if I have zeros and ones that are
constantly popping up at distinct times or first distinct period of time,
that that would constitute a pattern.
Now, we use pattern recognition to identify botnets or exfiltration of data,
we can also
utilize pattern recognition to identify if something
is anomalous within our network traffic.
Meaning if I have a specific IP address that we're
communicating with for 15 seconds every hour on the adder,
then that's a pattern that we need to
identify for a potential problem within our network.
Pattern recognition is utilized not just in malware,
but it's also utilized for storage capacity.
You can use pattern recognition to find out if your employees are
doing something that maybe they shouldn't or even to identify baseline traffic.
If you're continually every day, every one o'clock in the morning,
sending an update to your cloud provider to upload data
or to provide storage for your data against ransomware,
then that's a pattern.
But that's a good pattern.
If you're utilizing patterns to identify specific times of
the day when you're utilizing your antivirus programs,
obviously a good pattern.
But what if you are communicating from a specific specific client at a
specific time every single day for 15 seconds to an unknown IP address?
Well, that could lead to an indicator of compromise,
which is a militia pattern that you need to be aware of.
We use patterns not only against malware but for data exfiltration,
we use patterns to identify faults in our network.
Maybe we're seeing an error within our network traffic at a
specific time every 15 minutes that could throw faults to an it
position where not necessarily malicious in
use but could identify network problems
or even identify problems from our backhaul inside of our it infrastructure
add recognition to identify different faults
within the technology that we're using.
It could be used again against malware or it could identify problems
that are occurring in our technology where we can identify whether or
not something is getting ready to go bad or something that has
already gone bad and potentially open a vulnerability within our own network.
Pat recognition really is utilized not only for cybersecurity,
but also for it and repair of
those infrastructure problems within pattern recognition.
We often talk about how a command and control system or how our clients within our
internal network are communicating to a known bad IP address or maybe it's not note,
but we're seeing a pattern within the
traffic communicating to an outside IP address.
A lot of times that enters a command and
control infrastructure where our client or server is talking maybe
every hour or every 45 minutes for a specific time
to a specific IP address outside of our network.
We refer to that as a command and control base where
a malicious actor is utilizing a command control infrastructure to
talk to its malware that's intensive on our clients.
This could provide some malicious activity that we need to be aware of.
But command and controls can be utilized for more than just D
OS attacks or just malware.
You can also see it from a perspective of where the
command and control center is taking control of the botnets,
not just one client but multiple clients within our infrastructure
that could be indicator of compromise can repeat that to
a DDOS attack or denial service attack.
It could also be indicative of malware that's
communicating to a control center to expel data.
It could also be for a time bomb or a logic bomb inside of our internal network,
any type of those malware where we're having communication
to an unknown IP address outside of our network
on a known schedule indicates a pattern which then constitutes a command
and control center which could cause
some serious issues within our internal network
suts
commands that you need to be aware of could be file
manipulations where we're seeing manipulation of files at a distinct time.
Again,
that pattern recognition comes back into play with
how are these file manipulations taking place?
Are we seeing file manipulations, not on a specific timeline,
but maybe the same files are being manipulated
on one machine or more than one machine?
And it's happening across various aspects of our departments.
We can see where the timeline doesn't necessarily match up,
but the actual manipulation in the file matches up,
we can see system executions happening at a
distinct time or maybe they're happening in series
where one machine starts and then another machine
and it kind of cascades throughout our network.
Again, that's a pattern. We could see network configuration commands.
Maybe I've got a box inside my edge network where we're
doing an IP config or we're doing a ping command.
And then we're seeing that again,
that cascading effect from different systems across our network.
Now,
it doesn't mean that every single client or every single server
is going to send out that same network configuration command.
But maybe we're seeing at one point of our network and
then on various other points of our network which looks random.
But once you dive into it, you can start to see a pattern,
develop those patterns are indicative of malicious actors,
taking control of our network or somehow
injecting malware into our systems that usually
corresponds to data movement where data is moving from one client to another.
And it could also expel data exfiltration.
There are commands or malicious actors that
will move data from internal clients to a
server so that they can expel that data all at once at a specific time.
So you have to be careful that if I've
got clients that are sitting on different departments,
but they're all community
to the same server and they're moving data or infrastructure information
to that single point within your server or within your network architecture.
Do they have a reason to move that data?
Sometimes the answer is yes,
if I have a file server that I'm moving a lot of stuff for and that's where the file
are held up, that makes sense.
But if I have a lot of files that are moving maybe to a web server or an email server,
that necessarily is it used for that type of specific movement,
that could be an indicator of compromise.
The last point is unknown users.
If I have an unknown user,
maybe from the hr department that is now operating in the operations department or
maybe it's a brand new user that's
operating in several different departments simultaneously.
Is there a reason for that? Is that user have power or administrative privileges?
And if so, why do they have a
history of privileges?
We should have a list of every user that's
associated with admin privileges across our entire network.
If we don't understand that user or we don't recognize that user,
we need to shut it down pretty quickly.
And again, that would be indicative of a pattern.
Once that's completed, we need to go back through,
do an audit and figure out everything that that user touched.
If it was malicious in nature.
Throughout this episode,
we talked about different patterns and how to utilize those patterns.
How time of day really matters when it comes to pattern recognition.
But it's not just solely on the pattern of time.
We also have to look about what the communication process is taking place,
whether it's from one client or multiple clients
and how they're talking to one another really
that intuition or that gut feeling that you
have as a security analyst comes into play.
We have to have that careful mix of logic versus intuition in order to do our jobs.
Well, you should expect to see cys a exam questions specifically on the logic.
One of your exam,
we're not really going to see a lot of intuition in there because it's really
hard to measure that intuition when it comes to an exam like cys A.
So they're really going to concentrate on the logic portion of it
and really kind of make you think from a logical standpoint.
Now, you've probably heard me say logic, logic, logic.
And for the cys A exam that's important to know.
However in your real world job, you need to understand that those gut feelings,
that intuition that you have is going to play a much major
role in how you interact with different malicious actors or pattern recognition.
But for cys a stick to the logic and you should be fine.