How do you identify network threats from traffic patterns?

There are many tools available to help security teams establish a baseline. Any activity passed the baseline should be considered unusual and trigger further investigations. The best way to detect deviations from the baseline is to employ an intrusion detection system (IDS) or a network intrusion detection system (NIDS). Both systems can identify an attack signature or pattern in traffic packets. Moreover, a NGFW also has the capabilities to filter and block known attack patterns. Overall, the network baseline is important and should be monitored and adjusted through an automated process.

Additionally, if a malware is new and its signature patterns are not known, it can easily get passed detection systems. In this case, the best way to catch it would be to employ monitoring that will recognize anomalies. Many network monitoring and SIEM systems can make correlations in network traffic and detect unusual activities.

A network security anomaly is an unusual event or pattern indicating the presence of malicious activity, i.e. intrusion attempt, malware infection, or data exfiltration. Tools like Zeek, Snort IDS, and Maltrail can be used to detect and analyze these anomalies. Zeek performs detailed traffic analyses such as protocols, files being transferred, and other metadata. This information can then be used to investigate anomalies. Snort uses rule-based language to define malicious activity, Snort's community rules are regularly updated to detect the latest threats. Maltrail detects communication with known malicious sources. It can also detect if your network is communicating with Dark Web, with that information further analysis can be conducted.

Intrusion detection systems in layer 7 firewalls, IDS, Snort, Suricata, Zeek, pure packet capture. Some protocol analyzers can assist, also. Sure you can attempt to baseline what is normal traffic, but cybercriminals will change the game if they figure out your are on to them and you have to start all over discerning what their new strategy they have change to.

The SOC team may need to do multiple activities in parallel. For example, while trying to contain the threat a team member may start gathering and preserving evidence following the "order of volatility". Moreover, another team member may start conducting interviews while another looks for entry points.

After an incident response, it is important to review and check your performance. This activity can proceed in many ways. However, checking quantitative metrics can determine if more training is needed or if training was successful. These metrics may include, Mean Time To Detect (MTTD) and Mean Time To Recover (MTTR).

Overall, it is important to choose the best monitoring, detection, and prevention tools because they are your first line of defense.