The threat landscape is in a constant state of flux, with newly emerging, sophisticated technologies. The investment associated with security protection to handle the dynamic threat landscape is also becoming huge. Security protection is shifting from known threat detection to the early prevention of unknown threats. Big data frameworks, machine learning, and threat intelligence are the technologies that help to achieve the detection of unknown threats. Correlation analysis of abnormal events is key to detecting potential unknown threats.
The following diagram shows the concept of correlation or machine learning with different data sources:
The objective of network traffic analysis is to identify abnormal internal host traffic communications. The challenge posed by network traffic analysis is that the amount of data can be overwhelming. In addition, in...