Difference between a behaviour-based security and traditional firewall? As I have searched the web and honestly cannot find anything about it.
-
a firewall is like a deadbolt lock, whereas a behavior-based system is like a security guard that calls the cops when someone tries to break in.– dandavisMar 18, 2019 at 18:39
Add a comment
|
1 Answer
A traditional firewall allows or denies something based on the rules you defined. Any traffic passing through there will be filtered by the rules. If you want to change something (to adapt to a new threat) you will have to alter your rules.
Behavior-based security systems are designed to 'learn' what patters of usage you have in our network. After a while, they determine how traffic behaves overall and make automatically some general rules to allow those learned patters. If something unusual appears in the network, there will be triggered alerts or denial of traffic depending on the configuration. For example, if the system finds that your average user sends 50 e-mail per day, it makes a rule for that. If a user suddenly sends 500 instead, it will be blocked or signaled as suspect.
-
Also Behavior-Based security is more IDS than firewall, it looks for suspicious behaviour. It can also check for changes in log files, where it sees login attempts, etc. Mar 18, 2019 at 7:47
-
"it makes a rule for that" is not quite accurate. It just sets a baseline, and detects outliers from the baseline.– schroeder ♦Mar 18, 2019 at 8:08
-
1Worth to note: if there's already something malicious, it becomes part of the baseline. Mar 18, 2019 at 8:11
-
-
@ Esa Jokinen - correct, that is why one must make sure such a system in put in learning mode only if the status of the infrastructure is clean.– OvermindMar 18, 2019 at 11:08