And this episode we're going to talk about pattern recognition and why it's important for you as a cybersecurity
analyst to use pattern recognition.
Most times, people look at cybersecurity as purely a logical scheme for scientific measures, but that's
not necessarily true.
Cybersecurity is part intuition and part logic to form a analytical point of view that points to a specific
problem or a series of problems within your network.
Pattern recognition is the process of identifying recurring patterns or anomalies within your network.
That means to say that if I have zeros and ones that are constantly popping up at distinct times, or
for a distinct period of time, that that would constitute a pattern.
Now we use pattern recognition to identify botnets or exfiltration of data.
We can also utilize pattern recognition to identify if something is anomalous within our network traffic.
Meaning if I have a specific IP address that we're communicating with for 15 seconds every hour on the
matter.
Then that's a pattern that we need to identify for a potential problem within our network.
Pattern recognition is utilized not just in malware, but it's also utilized for storage capacity.
You can use pattern recognition to find out if your employees are doing something that maybe they shouldn't,
or even to identify baseline traffic.
If you're continually, every day, every 1:00 in the morning, sending an update to your cloud provider
to upload data or to provide storage for your data against ransomware, then that's a pattern.
But that's a good pattern if you're utilizing patterns to identify specific times of the day when you're
utilizing your antivirus programs.
Obviously a good pattern, but what if you were communicating from a specific client at a specific time,
every single day for 15 seconds to an unknown IP address?
Well, that could lead to an indicator of compromise, which is a malicious pattern that you need to
be aware of.
We use patterns not only against malware, but for data exfiltration.
We use patterns to identify faults in our network.
Maybe we're seeing an error within our network traffic at a specific time, every 15 minutes that could
throw faults to an IT position where not necessarily malicious in use, but could identify network problems
or even identify problems from our backhaul inside of our IT infrastructure.
Pattern recognition could identify different faults within the technology that we're using.
It could be used again against malware, or it could identify problems that are occurring in our technology,
where we can identify whether or not something is getting ready to go bad, or something that has already
gone bad, and potentially open a vulnerability within our own network.
Pattern recognition really is utilized not only for cybersecurity, but also for IT and repair of those
infrastructure problems.
Within pattern recognition, we often talk about how a command and control system, or how our clients
within our internal network are communicating to a known bad IP address.
Or maybe it's not known, but we're seeing a pattern within the traffic communicating to an outside
IP address.
Uh, a lot of times that enters a command and control infrastructure where our client or our server
is talking, maybe every hour or every 45 minutes for a specific time to a specific IP address.
Outside of our network.
We refer to that as a command and control base, where a malicious actor is utilizing a command and
control infrastructure to talk to its malware.
That's intrusive on our clients.
This could provide some malicious activity that we need to be aware of, but command and control can
be utilized for more than just DDoS attacks or just malware.
You can also see it from a perspective of where the command and control center is taking control of
the botnets not just one client, but multiple clients within our infrastructure that could indicator
of compromise, can repeat back to a DDoS attack or a denial of service attack.
It could also be indicative of malware that's communicating to a command and control center to exfiltrate
data.
It could also be for a time bomb or a logic bomb inside of our internal network Any type of those malware
where we're having communication to an unknown IP address outside of our network on a known schedule
indicates a pattern which then constitutes a command and control center, which could cause some serious
issues within our internal network.
Suspicious commands that you need to be aware of could be file manipulations, where we're seeing manipulation
of files at a distinct time.
Again, that pattern recognition comes back into play with how are these file manipulations taking place?
Are we seeing file manipulations?
Not on a specific timeline, but maybe the same files are being manipulated on one machine or more than
one machine, and it's happening across various aspects of our departments.
We could see where the timeline doesn't necessarily match up, but the actual manipulation of the file
matches up.
We can see system executions happening at a distinct time, or maybe they're happening in series where
one machine starts and then another machine, and it kind of cascades throughout our network.
Again, that's a pattern we can see.
Network configuration commands.
Maybe I've got a box inside my edge network where we're doing an ipconfig, or we're doing a ping command,
and then we're seeing that again, that cascading effect from different systems across our network.
Now, it doesn't mean that every single client or every single server is going to send out that same
network configuration command.
But maybe we're seeing at one point of our network and then on various other points of our network,
which looks random, but once you dive into it, you can start to see a pattern develop.
Those patterns are indicative of malicious actors taking control of our network, or somehow injecting
malware into our systems.
That usually corresponds to data movement, where data is moving from one client to another, and it
could also expel data exfiltration.
There are commands or malicious actors that will move data from internal clients to a server, so that
they can exfiltrate data all at once at a specific time.
So you have to be careful of that.
If I've got clients that are sitting on different departments, but they're all communicating to the
same server and they're moving data or infrastructure information to that single point within your server
or within your network architecture.
Do they have a reason to move that data.
Sometimes the answer is yes.
If I have a file server that I'm moving a lot of stuff for, and that's where the files are held up,
that makes sense.
But if I have a lot of files that are moving, maybe to a web server or an email server that necessarily
isn't used for that type of specific movement, that could be an indicator of compromise.
The last point is unknown users.
If I have an unknown user, maybe from the HR department that is now operating in the operations department,
or maybe it's a brand new user that's operating in several different departments simultaneously, is
there a reason for that?
Is that user have power or administrative privileges, and if so, why do they have administrative privileges?
We should have a list of every user that's associated with admin privileges across our entire network.
If we don't understand that user or we don't recognize that user, we need to shut it down pretty quickly.
And again, that would be indicative of a pattern.
Once that's completed, we need to go back through and do an audit and figure out everything that that
user touched, if it was malicious in nature.
Throughout this episode, we talked about different patterns and how to utilize those patterns, how
time of day really matters when it comes to pattern recognition.
But it's not just solely on the pattern of time.
We also have to look about what the communication process is taking place, whether it's from one client
or multiple clients, and how they're talking to one another.
Really, that intuition or that gut feeling that you have as a security analyst comes into play.
We have to have that careful mix of logic versus intuition in order to do our jobs well.
You should expect to see Cisa exam questions specifically on the logic front of your exam.
We're not really going to see a lot of intuition in there, because it's really hard to measure that
intuition when it comes to an exam like Cisa.
So they're really going to concentrate on the logic portion of it and really kind of make you think
from a logical standpoint.
Now you've probably heard me say logic, logic, logic.
And for the Cisa exam that's important to know.
However, in your real world job, you need to understand that those gut feelings, that intuition that
you have is going to play a major role in how you interact with different malicious actors or pattern
recognition.
But for Cisa, stick to the logic and you should be fine.