Maintain Anomaly Sensors. Objective To configure anomaly detection sensors to reduce the rate of false positives, and make them more sensitive to signs of real incidents. Activities • Tweak and review baselines or models • Suppress incident types or categories Most anomaly detection sensors are self-learning. They are first deployed in learning mode, where they made a baseline of the normal behavior of the network of system they monitor. In this way, the sensor is customized to the situation in that network or system. After the automated learning phase, there is however usually a need to also manually tune the sensor. The main goal is to reduce false positive rates. The sensor may not be able to learn all normal behavior automatically. The sensor may for instance not see maintenance work on every substation during the learning phase. It will then generate alerts whenever maintenance is done on a substation (except if the substation happened to be maintained during learning). Human analysts can recognize the pattern of alerts cause by maintenance, and tune the sensor not to generate the anymore. Besides tuning the sensors to reduce false positives, many sensors should also be reviewed to maintain their detection capabilities. During tuning, more and more causes of false positive are added to the base- line of normal behavior. The sensor becomes less sensitive. Attackers may exploit this by slowly adding steps in their planned attack to the baseline, disguised as false positive. For instance, if they need a certain connection for their attack that is not in the baseline, they may first open that connection for a harmless purpose. Analysts will then likely classify it as a false positive, and add it to the baseline. When the real attack comes, the connection will no longer trigger an alert. Analysts should therefore regularly review the baseline to check if all the behavior allowed by it, is indeed normal and needed for normal operations. This is not a simple task, as it requires a thorough understanding of the sensor and the system being monitored. Some sensors do not even allow such reviews. But without this capability, the detection capabilities will likely degrade over time. In some cases, the same goal could be achieved by relearning the sensor after a certain period.
