Monitoring and alerting
The Using supervised learning example section of Chapter 5, Keeping Your Network Clean, shows one method for monitoring your network for unusual patterns. In this case, you monitor API calls that are coming into your network from an outside source. Previous chapters have also provided you with examples of email filtering, anomaly detection, malware detection, and fraud detection. All of these kinds of detection are helpful, but monitoring and alerting for hacker attacks, in general, is harder. The point of the sections that follow is to show that you can create a combination of detection methods to ascertain the health of your organization in general so that it becomes possible to create an alert when there is a high probability that a hacker attack is about to begin.
Considering the importance of lag
Humans don’t act instantly. Even when humans are actively engaged in something, there is a reaction time to consider. For example, try the interesting...
