Anomaly-based threat detection: Behavioural fingerprinting versus self-learning AI

Jeff Cornelius, Simon Fellows, Oakley Cox and Sam Lister
Additional contact information
Jeff Cornelius: Darktrace, USA
Simon Fellows: Darktrace, UK
Oakley Cox: Darktrace, New Zealand
Sam Lister: Darktrace, UK

Cyber Security: A Peer-Reviewed Journal, 2022, vol. 6, issue 1, 14-25

Abstract: When a malicious actor has access to a digital estate, they control compromised devices and user accounts to achieve their objectives. Given that an attacker’s objectives are often at odds with devices’ normal patterns of life, identifying deviations from these patterns can be used to detect an ongoing attack. This paper outlines and compares two approaches to anomaly-based threat detection: behavioural fingerprinting and self-learning artificial intelligence (AI). It argues that the self-learning approach is significantly superior in several important ways due to the fact it provides a more complex and accurate understanding of what is normal. The paper explains the motivation behind anomaly-based threat hunting, describes the fingerprinting approach and the self-learning approach to anomaly detection, and details real-world examples that demonstrate the advantages of the self-learning approach.

Keywords: artificial intelligence; machine learning; anomaly detection; self-learning; behavioural fingerprinting (search for similar items in EconPapers)
JEL-codes: M15 (search for similar items in EconPapers)
Date: 2022
References: Add references at CitEc
Citations:

Downloads: (external link)
https://hstalks.com/article/7177/download/ (application/pdf)
https://hstalks.com/article/7177/ (text/html)
Requires a paid subscription for full access.

Related works:
This item may be available elsewhere in EconPapers: Search for items with the same title.

Export reference: BibTeX RIS (EndNote, ProCite, RefMan) HTML/Text

Persistent link: https://EconPapers.repec.org/RePEc:aza:csj000:y:2022:v:6:i:1:p:14-25

Access Statistics for this article

More articles in Cyber Security: A Peer-Reviewed Journal from Henry Stewart Publications
Bibliographic data for series maintained by Henry Stewart Talks ().