In this chapter, we discussed unknown threat detection techniques involving identifying abnormalities in network traffic and host behaviors. To identify and visualize potential threats in network traffic, we introduced two open source tools—Malcom and Maltrail. Malcom helps connection relationship diagram and also potential C&C server connections.
As regards the host behaviors, we explained IOCs and discussed some abnormal host behaviors for potential threats. Different aspects of web access log analysis were also discussed, including an external source of client IP, client fingerprints, website reputation, DGAs, and DNS query.
We also suggested some open source frameworks for an organization that would like to build an in-house security analysis big data framework. TheHive and MISP can collaborate in connection with threat analysis. Apache Metron provides...