Bimodal distribution

As explained in Cyber Threat Hunting

A bimodal distribution is a probability distribution with two distinct peaks or modes.

A bimodal distribution has two distinct peaks rather than one bell-shaped concentration. In anomaly analysis, this pattern can make a low standard deviation misleading: tightly packed values may still form two groups. section 7.1.2

Call-home timing

The variable time_difference_sec forms a bimodal distribution, with two peaks. Jitter introduced into call-home connections may change the observed shape, so analysts use quartiles and the interquartile range before calculating variance and standard deviation. section 7.1.2

Use the distribution shape to guide analysis:

• Check whether values follow a normal, unified distribution before relying on standard deviation. section 7.1.2
• Use the interquartile range to focus on values between the lower and upper quartiles and reduce sensitivity to outliers and skewed data. section 7.1.2

Figure 7.3 Distribution of time_diff_sec, taken from chapter 6

Inspect the plotted time_diff_sec distribution associated with the bimodal example. section 7.1.2

How Cyber Threat Hunting covers it

How deep it goes

Defines two peaks and connects them to standard deviation, IQR, quartiles, outliers, and skewed data.

Examples

Uses call-home connection intervals, time_difference_sec, jitter, distribution figures, and pandas filtering listings.

What it assumes

Builds from normal distributions and standard deviation, then introduces quartiles and IQR for nonnormal data.

What you can do after

Apply it via pandas to recognize two-peaked timing data and choose IQR-based filtering before dispersion calculations.

How it connects

Connects bimodal distribution with normal distribution, standard deviation, variance, interquartile range, quartiles, and skewed data.

liveBookmanning.com

Read Cyber Threat Hunting on liveBook Get the book at manning.com

Related concepts

• prior probabilitykind of · A prior probability distribution represents beliefs or assumptions about an unknown quantity before relevant observations or evidence are incorporated.
• data segmentationused by · Data segmentation is the partitioning of observations into groups with shared characteristics for separate analysis or comparison.
• mixture modelused by · A mixture model is a probabilistic model representing a distribution as a weighted combination of component probability distributions.
• normal distributioncontrasts with · A normal distribution is a continuous probability distribution with a symmetric, bell-shaped density determined by its mean and variance.

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.