D3-SDA
Session Duration Analysis
Definition
Analyzing the duration of user sessions in order to detect unauthorized activity.
How it works
Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model. The behavior model comprises historical user session duration times. Abnormalities between session duration and the behavior model may indicate suspicious activity.
Considerations
•Potential for false positives from anomalies that are not associated with malicious activity.
•Attackers may not differentiate their session duration enough to trigger an alert.