Keys to Effective Anomaly Detection

by Matt Bromiley
Sept. 1, 2017 0 comments SANS Institute Detection & Response data protection

Simply put, an anomaly is something that seems abnormal or doesn’t t within an environment. A car with ve driving wheels would be an anomaly. In the context of an enterprise network, an anomaly is very much the same—something that does not t or is out of place. While anomalies in an enterprise network may be indicative of a con guration fault, they are often evidence of something much more worrisome: a malicious presence on the network.