3.5 Detecting Network Attacks（检测网络攻击）

LO 5 · EK 23 ｜ 严格按大纲顺序学习

▶ 从第一个 EK 开始看课件（幻灯片，可翻页/全屏） 点击下方任意 EK 编号（如 3.5.A.1）也可直接进入对应课件页

学习目标 Learning Objectives

3.5.A Identify types of automated security tools used to detect network attacks.

- [3.5.A.1](/ek/3.5.A.1) — Automated detection tools analyze data collected from an organization’s network and devices, suc… - [3.5.A.2](/ek/3.5.A.2) — A network intrusion detection system (NIDS) is an automated tool that analyzes data to determine… - [3.5.A.3](/ek/3.5.A.3) — A network intrusion prevention system (NIPS) is an automated tool that, like an IDS, analyzes da… - [3.5.A.4](/ek/3.5.A.4) — A security information and event management (SIEM) system collects and analyzes data from multip…

3.5.B Explain how organizations can leverage artificial intelligence (AI) to enhance threat detection and response.

- [3.5.B.1](/ek/3.5.B.1) — Computers log every action that users take. Firewalls, IDS, IPS, and other network sensors log a… - [3.5.B.2](/ek/3.5.B.2) — Threat detection teams are creating AI algorithms to analyze large amounts of data and classify … - [3.5.B.3](/ek/3.5.B.3) — AI models for threat detection are based on probabilistic calculations; they report a percentage… - [3.5.B.4](/ek/3.5.B.4) — Organizations determine their own thresholds for what percentage of likelihood of a threat resul…

3.5.C Identify types of automated security tools used to detect network attacks. Explain how organizations can leverage artificial intelligence (AI) to enhance threat detection and response. Determine a network detection method. 3B

- [3.5.C.1](/ek/3.5.C.1) — Volume of network traffic is a criterion for determining a detection method. Signature- based de… - [3.5.C.2](/ek/3.5.C.2) — Consistency of network traffic patterns is a criterion for determining a detection method. Anoma… - [3.5.C.3](/ek/3.5.C.3) — Degree of sensitivity or criticality of a network is a criterion for determining a detection met… - [3.5.C.4](/ek/3.5.C.4) — Likelihood of novel attacks on a network is a criterion for determining a detection method. Sign…

3.5.D Evaluate the impact of a network detection method.

- [3.5.D.1](/ek/3.5.D.1) — Speed of detection is a factor in evaluating the impact of a network detection method. Faster de… - [3.5.D.2](/ek/3.5.D.2) — Cost is a factor in evaluating the impact of a network detection method. Detection tools and ong… - [3.5.D.3](/ek/3.5.D.3) — False positive rate is a factor in evaluating the impact of a network detection method. Signatur… - [3.5.D.4](/ek/3.5.D.4) — False negative rate is a factor in evaluating the impact of a network detection method. A false …

3.5.E Apply detection techniques to identify indicators of network attacks by analyzing log files.

- [3.5.E.1](/ek/3.5.E.1) — Evil-twin attacks can be detected by regularly scanning for service set identifiers (SSIDs) that… - [3.5.E.2](/ek/3.5.E.2) — Jamming attacks can be detected by recognizing that no wireless devices in a specific physical s… - [3.5.E.3](/ek/3.5.E.3) — ARP poisoning attacks can be detected by monitoring network traffic for unusual ARP messages (pa… - [3.5.E.4](/ek/3.5.E.4) — MAC flooding attacks can be detected by monitoring network traffic for an unexpected surge of Et… - [3.5.E.5](/ek/3.5.E.5) — DNS poisoning attacks are difficult to detect. However, if an organization’s website experiences… - [3.5.E.6](/ek/3.5.E.6) — Smurf attacks can be detected by watching network traffic for a sudden increase in ICMP requests… - [3.5.E.7](/ek/3.5.E.7) — Network-based IoCs are discovered when analyzing network traffic, often in the form of packet ca…

---

← 返回单元 Unit 3