ConceptsNetwork Anomaly Detection

Network Anomaly Detection

Detecting unusual network behavior, traffic that deviates from baselines, rare destinations, atypical volumes or patterns, on the premise that abnormality often indicates malicious activity. A core network-detection technique.

Glossary definition

7 direct links1 lesson

Concept Neighborhood

Prerequisite · arrow shows the orderRelated · bigger circles cover more lessons

Start here

Baseline Analysis

The foundation Network Anomaly Detection builds on, worth understanding first.

Open concept →

Prerequisitelearn this first

Baseline AnalysisStart here

Establishing what normal activity looks like in an environment so that deviations stand out as worth investigating. In detection and SIEM work, the baseline is the reference against which anomalies are measured.

lessons

Relatedsorted by lesson coverage

Flow Data

lessons

Network Telemetry

lessons

Anomaly Detection

lesson

Beacons

lesson

Network Alerts

lesson

Network Reconnaissance

lesson

Related Lessons

1 lesson covers this concept

Common Detection Patterns

SOC Analyst