4B. Analyse and Query logs and SIEM data obj 3.1

Question 1

Heuristic-based analysis

Answer 1

A method that uses feature comparisons and likenesses rather than specific signature matching to identify whether the target of observation is malicious.

Question 2

Behaviour-based analysis

Answer 2

A network monitoring system that detects changes in normal operating activity and identifies abnormal activity. Uses heuristics to generate a statistical model of what the baseline looks like

Question 3

Anomaly-based analysis

Answer 3

the process of defining an expected outcome or pattern to events, and then identifying any events that do not follow these patterns

Question 4

Trend analysis

Answer 4

process of detecting patterns within a dataset over time and using those patterns to make predictions about future events. Can help to judge that specific events over time are related and possibly indicate that an attack is imminent

Question 5

awk

Answer 5

The feature awk is a scripting engine geared toward modifying and extracting data from files or data streams, which can be useful in preparing data for analysis