D3-SDA Session Duration Analysis

Analyzing the duration of user sessions in order to detect unauthorized activity.

How it works Detecting unauthorized user sessions by comparing the duration of a user logon session with a baseline behavior model. The behavior model comprises historical user session duration times. Abnormalities between session duration and the behavior model may indicate suspicious activity. Considerations • Potential for false positives from anomalies that are not associated with malicious activity. • Attackers may not differentiate their session duration enough to trigger an alert.