D3-RAPA
Resource Access Pattern Analysis
Definition
Analyzing the resources accessed by a user to identify unauthorized activity.
How it works
This technique analyzes a user's resource accesses by comparing the user's recent activity against a baseline activity model. Major differences between the current activity and the baseline model might indicate unauthorized activity if they are severe enough.
Considerations
•Potential for false positives from anomalies that are not associated with malicious activity.
•Attackers that move low and slow may not differentiate their resource access activity behavior enough to trigger an alert.