Intrusion Detection, Monitoring, and Security Analytics
Detecting Adversaries in Complex Systems
Detection Engineering
Detection is the art of converting telemetry into actionable signal. Advanced monitoring requires careful data collection, feature engineering, alert tuning, and validation against realistic adversary behavior.
Telemetry Sources
Signature-Based vs Behavior-Based Detection
Signature-Based
- Matches known indicators
- Fast and precise for known threats
Behavior-Based
- Looks for suspicious actions or sequences
- Better against novel or modified threats
What is a major advantage of behavior-based detection?
Behavior-based approaches generalize beyond exact signatures and can identify new variants.
Correct answer: It can better identify novel attacker behavior
Why is alert tuning necessary in security operations?
Detection systems are only effective if alerts are actionable and prioritized.
Correct answer: To reduce false positives and improve analyst attention on high-value events.
Analytics Pipeline
-
1
Step 1: Define the adversary behaviors to detect.
-
2
Step 2: Collect and normalize relevant telemetry.
-
3
Step 3: Build rules or models with measurable objectives.
-
4
Step 4: Test against benign and adversarial datasets.
-
5
Step 5: Measure precision, recall, and operational burden.
Which metric is most directly associated with missed detections?
Recall measures the fraction of actual malicious events that are correctly detected.
Correct answer: Recall
Research Insight
A detection rule should be judged not just by whether it fires, but by whether it supports a useful response decision in time.