Anomaly detection concepts in Cybersecurity - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is anomaly detection in cybersecurity?

Anomaly detection is the process of identifying unusual patterns or behaviors in data that do not conform to expected norms. In cybersecurity, it helps find potential threats or attacks by spotting activities that differ from normal system behavior.

beginner

Name two common types of anomalies detected in cybersecurity.

The two common types are:<br>1. Point anomalies: Single data points that are unusual.<br>2. Contextual anomalies: Data points that are unusual in a specific context, like time or location.

beginner

Why is anomaly detection important for cybersecurity?

It helps detect unknown or new threats that signature-based methods might miss. By spotting unusual behavior early, it can prevent damage from attacks like intrusions, fraud, or malware.

intermediate

What is a false positive in anomaly detection?

A false positive happens when normal behavior is mistakenly flagged as an anomaly. This can cause unnecessary alerts and waste time investigating harmless activities.

beginner

List one common method used for anomaly detection.

Statistical methods are common, where the system learns normal data patterns and flags data points that deviate significantly from these patterns.

What does anomaly detection primarily identify?

A Network speed

B Known malware signatures

C User passwords

D Unusual patterns or behaviors

Anomaly detection focuses on finding unusual or unexpected patterns that differ from normal behavior.

Which of these is a type of anomaly?

A Scheduled anomaly

B Routine anomaly

C Contextual anomaly

D Normal anomaly

Contextual anomalies are unusual data points that are abnormal in a specific context, such as time or location.

What is a false positive in anomaly detection?

A A system crash

B Normal behavior flagged as abnormal

C A correct detection of an anomaly

D An attack that goes undetected

A false positive occurs when normal activity is mistakenly identified as an anomaly.

Why is anomaly detection useful in cybersecurity?

A To detect unknown threats

B To speed up the internet

C To store passwords securely

D To backup data

Anomaly detection helps find new or unknown threats by spotting unusual behavior.

Which method is commonly used in anomaly detection?

A Statistical analysis

B Password cracking

C Data deletion

D File compression

Statistical analysis helps identify data points that differ significantly from normal patterns.

Explain what anomaly detection is and why it matters in cybersecurity.

Think about how spotting unusual activity helps protect systems.

Describe the difference between a false positive and a true anomaly in anomaly detection.

Consider what happens when the system makes a mistake.