- In the security operations center, or in the SOC,
we need to quickly detect abnormal traffic, that's a given.
Unfortunately, many different traditional detection methods
take a lot of computational overhead,
which will make it hard
to meet the real-time requirement that we need, nowadays,
especially to detect different sophisticated attacks.
Now, there are many different studies and solutions
that provide a distributed network traffic
anomaly detection algorithm,
based on a concept called the sliding window,
which is, basically,
through this sliding time, or sliding time-window,
traffic anomaly detection will be limited
to only the specific amount of time,
so, the scope is a lot smaller.
Now, this significantly reduced the amount of data analysis
to improve the speed of anomaly detection,
and to be able to scale,
be able to actually reduce the need
of all that overhead of computational analysis,
and, basically, take advantage of this sliding time-window
for that specific limited scope of time.