What is an anomaly?¶

An anomaly is activity that differs from an expected pattern or baseline.

Avoid the dangerous assumption¶

The dangerous assumption is that unusual activity is necessarily malicious.

It is not.

An anomaly may involve a new login location, unusual working hours, an unfamiliar device, a sudden increase in data transfer, a process not normally seen on the system, access to an unusual resource, a change in user behaviour or network traffic outside the normal pattern.

Anomalies are useful because attackers often behave differently from ordinary users or systems. But legitimate change also produces anomalies.

A staff member may travel.

A new application may be deployed.

A system migration may move large amounts of data.

An administrator may perform emergency work.

A user’s role may change.

The quality of an anomaly depends on the baseline. A product may compare the activity with that user, device, organisation, sector or wider population. The investigator should ask which comparison was used.

Also ask how much historical data supported the baseline. A newly created account may appear anomalous simply because little normal activity exists.

An anomaly may justify further investigation even where no known malicious indicator is present. It may help identify account takeover, insider misuse, automated activity or previously unseen methods.

It does not prove intent, compromise or identity.

Corroborate the anomaly with other records. Identify the account, device, process, location, time and action involved. Check whether there was a legitimate operational reason.

For reporting, describe the activity and the basis on which it was considered unusual rather than using “anomalous” as a substitute for “malicious”.

Operational takeaway¶

Use anomalies to identify departures from expected behaviour, then test whether the difference reflects malicious activity, legitimate change or an incomplete baseline.