Anomaly Detection

Anomaly Detection appears to be a sophisticated technique used by Bitdefender to detect applications or processes exhibiting suspicious behavior, customized to each endpoint:

Our custom machine-learning models used in anomaly detection are trained individually on each customer’s system. This is not a mistake, each system in each customer’s environment has its own machine-learning model, customized for the uniqueness of that system.

However, I do not see Anomaly Detection in the Features by Product or Features by Operating System lists. Specifically, is this feature available for GravityZone Small Business Security on macOS?

Find more posts tagged with

protection for macos

Accepted answers

All comments

Andrei_S Enterprise

Hello @Pleonasm ,

The anomaly detection techniques are used by the EDR sensor (available for macOS) and Integrity Monitoring

addon (not available for macOS).

The model observes the system's behavior, trying to find anomalies in the observed behavior of users, processes, and the system. Using an EDR sensor that monitors activity data and generates events related to User Logins, Network Connections, and Process Creations, we could build an Anomaly Detection system on top of EDR events. This involves correlating events, extracting, and processing features, and creating a behavioral baseline. Any deviation from the baseline can be considered potentially malicious.

The reason why it is not listed in the features list is that the anomaly detection are a series of techniques used by different modules as listed above.

Kind Regards,

Andrei

Pleonasm

Thank you, @Andrei_S Enterprise, for the very helpful clarification.