D3-RAPA Resource Access Pattern Analysis

Analyzing the resources accessed by a user to identify unauthorized activity.

How it works This technique analyzes a user's resource accesses by comparing the user's recent activity against a baseline activity model. Major differences between the current activity and the baseline model might indicate unauthorized activity if they are severe enough. Considerations • Potential for false positives from anomalies that are not associated with malicious activity. • Attackers that move low and slow may not differentiate their resource access activity behavior enough to trigger an alert.