3 — Analysis: misuse vs anomaly detection

Study time: ± 60 minutes (reading + hands-on)

Turning data into alerts

Analysis is where raw events become alerts. There are two fundamentally different philosophies, and the tension between them is the heart of detection.

Misuse detection (signature-based)

Look for known-bad patterns — "signatures" of documented attacks, often tied to CVE identifiers. Tools like Snort and Suricata work this way.

Strength: clear diagnosis. When it fires, you know exactly what the attack is.
Weakness: blind to anything new (no signature = no detection), and needs constant updates.

Anomaly detection (behaviour-based)

First learn what "normal" looks like, then flag deviations. Tools like Zeek use specification-based detection (does traffic follow the rules it should?).

Strength: your best chance against novel, "zero-day" attacks.
Weakness: far more false alarms; needs heavy tuning. Machine learning shows up here as a classification tool — useful, but not magic, and itself a target (attackers craft input to evade models).

The base-rate fallacy (the key idea)

Because benign events outnumber attacks by a huge margin, even a very accurate sensor produces a flood of false positives. This is the base-rate fallacy (formalised by Axelsson), and it is the mathematical reason a SOC that does not tune its sensors ends up buried in noise and misses the real incident. This is also why a SOC is a socio-technical system: technology + processes + people, none working alone.

Core resources

Snort (signature-based) and Zeek (behaviour/specification-based) — compare the two philosophies hands-on. (± 30 min)
CyBOK KA 8, section 3 (Analyse) — detection algorithms and the base-rate fallacy. (± 20 min)

Check yourself

Explain misuse vs anomaly detection, and give one weakness of each.
What is the base-rate fallacy, and why does it force a SOC to tune its sensors?
Why is machine learning not a "silver bullet" for detection?
Why is a SOC called a socio-technical system rather than just a set of tools?