liveBook · Manning

Probability distribution

As explained in Cyber Threat Hunting

A statistical distribution describes the frequencies, probabilities, or arrangement of values across possible observations.

A probability distribution summarizes how observed values are arranged and how frequently they occur. In threat hunting, it reveals regularity that a simple average or standard deviation can miss, helping investigators examine beaconing, anomalies, outliers, and possible data exfiltration. section 7.0 section 7.1.5

Use a distribution to investigate a field or communication pattern:

  • Plot the values as a histogram or distribution chart, then inspect concentration, skew, tails, peaks, and gaps. section 7.1.5 section 7.1.7
  • Compare recurring values with related fields to test whether a concentration reflects suspicious beaconing rather than ordinary variation. section 7.1.7

Detecting repeated connection sizes

Connections from 10.0.0.4 to Dropbox-related addresses containing 162.125 showed 845 bytes in 49.3% of connections; the same value appeared in 18.9% of connections from 10.0.0.18. Grouping bytes with the TLS client cipher list showed 149 and 168 occurrences respectively, making the repeated size worth investigating as possible beaconing. section 7.1.7

How Cyber Threat Hunting covers it

How deep it goes
Explains filtering, grouping, charting, skew, concentration, and tails, but defers formal probability theory.
Examples
Demonstrates time-difference histograms and byte distributions for connections from two endpoints to 162.125 addresses.
What it assumes
Builds from earlier standard-deviation analysis and extends it with histograms, quantiles, and interquartile-range reasoning.
What you can do after
Diagnose suspicious communication by plotting field values, recognizing distribution patterns, and comparing recurring values across related fields.
How it connects
Connects distributions with beaconing, random jitter, standard deviation, quantiles, histograms, anomalies, and outliers.
Cover of Cyber Threat Hunting
liveBookmanning.com
Read Cyber Threat Hunting on liveBook Get the book at manning.com

Also explained in

Compare how 27 books explain probability distribution →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Cyber Threat Hunting. The section links point to the parts of the book it draws on.