What does Behavior-based analytics focus on in Threat Actor Attribution?

Behavior-based analytics is a method used in cybersecurity to detect and attribute threats by focusing on the actions and patterns of users and entities. This approach first establishes a baseline of normal, everyday behavior for each user, host, and network flow. It then continuously monitors activities, applying statistical analysis and machine learning to identify significant deviations or anomalies from this established baseline. Such anomalies, which could represent an attacker's Tactics, Techniques, and Procedures (TTPs), are flagged as potential threats, aiding in both detection and subsequent attribution efforts.

A. Metadata analysis is a component of broader security investigations but is not the core principle of behavior-based analytics, which focuses on actions and patterns over time.

B. Identifying known IP addresses is a form of static, indicator-based detection (IOCs), which contrasts with the dynamic, pattern-oriented approach of behavior-based analysis.

D. Using encryption techniques is a method for securing data or a tool used by threat actors; it is not an analytical process for detecting anomalous behavior.

---

1. Cisco Systems, Inc., "What Is UEBA (User and Entity Behavior Analytics)?". Cisco Official Documentation. Accessed 2023. In the main overview, it states: "UEBA solutions start by building a baseline of typical behavior for users and entities... Then, they look for anomalous events that deviate from that baseline. These solutions can detect threats from insiders or external attackers who have compromised an insider's account." This directly supports the concept of analyzing user behavior for anomalies.

2. Cisco Systems, Inc., "Cisco Secure Network Analytics (Stealthwatch) Data Sheet". Document ID: C22-734531-19. In the "Product overview" section, it describes the system's function: "It continuously monitors the network to provide real-time threat detection... by baselining the network and identifying anomalous behavior." This exemplifies the practical application of behavior-based analytics in a core Cisco security product.

3. Bromiley, M., "Behavioral Analysis and Anomaly Detection to Stop Modern Threats". SANS Institute InfoSec Reading Room, November 2016. Page 4, Section "Behavioral Analysis". The paper defines the concept: "Behavioral analysis is the process of establishing a baseline of 'normal' activity and then searching for deviations from that baseline... This is the core of anomaly detection." This source from a reputable security institution corroborates the definition.