Johannesburg, 04 Sep 2019
Imagine you could stop a person committing a heinous crime before they had even attempted to. Would you?
This may not be possible in the physical world, but using the LucidView approach, it most certainly is in the digital world.
Behaviour-based intrusion detection and prevention analyses traffic patterns and behaviour. While this might sound like technical mumble-jumble, it’s not, and it's extremely effective at identifying behaviour that is anomalous or deviant and poses a security threat to your network and, more importantly, mitigating the risk immediately.
Deviant is a psychological term. However, for the purposes of this article, its definition is spot on. Deviant behaviour refers to a behaviour that does not conform to social norms and values. Sociologists and psychologists will go on to list a number of signs that are used to determine deviant behaviour and categorise patients based on what is a socially accepted norm and what is not, and often, a diagnosis will be given and the patient treated. And while there are many debates as to the accuracy and methodology used here, the theory itself can be effectively applied when it comes to proactively protecting your networks and devices from malware, ransomware, DDOS attacks and zero-day attacks.
Why is this definition important in terms of cyber security? Well, imagine for a moment that we could watch a human being's behaviour in its very early stages, and conclude at that point this human has all the characteristics of a sociopath and will most likely turn to crime at a later stage, if not dealt with immediately. We would be able to reduce crime proactively.
Unfortunately, human beings are more complex, and society, at this stage, can only deal with known crimes. Society cannot prevent crime before it happens, it can only punish and eliminate the offending criminal once the crime has been committed.
This, broadly, is the difference between behaviour-based IDPS and signature-based IDPS.
Signature-based IDPS is reactive, it can only respond once the crime has occurred. Signature-based IDPS relies on already defined behaviour that it has catalogued in its database. It compares all network traffic to the signatures it has already labelled and categorised. As such, when a malware program is installed, the signature-based IDPS looks at the malware, compares it to code it has categorised in its database and, based on this, decides whether to blacklist the malware or not.
The risk of relying on signature-based IDPS here is clear. Signature-based IDPS does not have the ability to protect your network proactively and thus leaves your entire network vulnerable to a zero-day attack, malware or ransomware that is not in its existing library. A zero-day attack is an attack that is new and hasn’t been seen before and, as such, is not guarded against in the signature database.The cyber criminals out there know what signatures have been collected and you can be certain they are spending their time finding more and more sophisticated ways to circumvent this.
Behaviour-based IDPS, however, does not use already known signatures to protect your network. Behaviour-based IDPS monitors all the traffic that flows into or out of your network and is designed to detect behaviour that is atypical or deviant. Since we aren’t dealing with human beings here, just IP addresses, connections and other data, killing off these deviants before they have a chance to take root is the best form of defence. Behaviour-based IDPS, by its very nature, has a higher probability of identifying and eliminating a zero-day attack, identifying a ransomware connection and removing it. In other words, when it comes to your cyber security, behaviour-based profiling is extremely effective and provides you with the ability to proactively prevent an attack on your network.
Enforce your Internet security with our 100% white label MikroTik Enforcer. Feel free to take advantage of our 30-day free trial. Please do contact us should you have any queries.
Share