0

Difference between a behaviour-based security and traditional firewall? As I have searched the web and honestly cannot find anything about it.

  • a firewall is like a deadbolt lock, whereas a behavior-based system is like a security guard that calls the cops when someone tries to break in. – dandavis Mar 18 at 18:39
1

A traditional firewall allows or denies something based on the rules you defined. Any traffic passing through there will be filtered by the rules. If you want to change something (to adapt to a new threat) you will have to alter your rules.

Behavior-based security systems are designed to 'learn' what patters of usage you have in our network. After a while, they determine how traffic behaves overall and make automatically some general rules to allow those learned patters. If something unusual appears in the network, there will be triggered alerts or denial of traffic depending on the configuration. For example, if the system finds that your average user sends 50 e-mail per day, it makes a rule for that. If a user suddenly sends 500 instead, it will be blocked or signaled as suspect.

  • Also Behavior-Based security is more IDS than firewall, it looks for suspicious behaviour. It can also check for changes in log files, where it sees login attempts, etc. – Antonio Zunic Mar 18 at 7:47
  • "it makes a rule for that" is not quite accurate. It just sets a baseline, and detects outliers from the baseline. – schroeder Mar 18 at 8:08
  • 1
    Worth to note: if there's already something malicious, it becomes part of the baseline. – Esa Jokinen Mar 18 at 8:11
  • Interesting, thank you this has really helped a lot. :) – Wolfinator Mar 18 at 8:23
  • @ Esa Jokinen - correct, that is why one must make sure such a system in put in learning mode only if the status of the infrastructure is clean. – Overmind Mar 18 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.