AP® Cybersecurity · Unit 3: Securing Networks · Topic 3.5
Detecting Network Attacks
Network attack detection is the process of collecting evidence about network activity, comparing it with known threats and expected behavior, investigating meaningful deviations, and reporting possible incidents so authorized responders can act.
What does network attack detection involve?
A network continuously produces evidence: connection records, device identities, authentication events, firewall decisions, DNS requests, cloud activity, bandwidth measurements, and alerts. Defenders use that evidence to answer three questions: What happened? Is it suspicious? What should happen next?
Detection is not the same as proving an attack. An alert is a lead that needs context. A late-night login could be an intruder, a teacher working from another time zone, or an approved automated process. Good investigation connects multiple facts before reaching a conclusion.
Expected for this network
Known devices, approved applications, usual login locations and hours, predictable traffic volumes, documented maintenance, and authorized destinations form a baseline. Normal is specific to the environment and can change.
Unusual, prohibited, or threat-linked
A deviation becomes more important when it affects a critical asset, matches a known indicator, repeats, combines with other warnings, or conflicts with policy. Unusual does not automatically mean malicious.
Indicators of compromise and network warning signs
An indicator of compromise (IOC) is observable evidence that may be associated with a security incident—for example, a known-malicious destination, an unexpected account action, or a suspicious file hash. IOCs are useful clues, not automatic proof.
Unexpected traffic spikes may indicate a popular event, backup, misconfiguration, denial-of-service activity, malware spread, or large data transfer. Compare time, source, destination, and business context.
Unusual logins and repeated failures include access from unfamiliar locations or devices, impossible travel, many failed attempts, disabled accounts being used, and successful access immediately after failures.
Unknown devices, unexpected IP addresses, or unauthorized wireless access points can signal inventory gaps, a guest device on the wrong segment, an unsafe hotspot, or unauthorized access.
Connections to many ports or hosts in a short period may resemble scanning. Investigators check whether the source is an approved monitoring or inventory tool before escalating.
Unusual protocol use means traffic that is unexpected for a device or crosses a boundary it normally would not. A printer initiating remote-administration traffic is more concerning than expected print traffic.
Suspicious outbound traffic may include regular “beacon-like” contacts, communication with threat-listed infrastructure, unusually large uploads, or a device contacting a new country or cloud service.
Service slowdown or unavailability accompanied by sharply increased requests, resource exhaustion, or many distributed sources may indicate a DoS or DDoS event. Hardware faults and legitimate demand must also be considered.
Command-and-control behavior can appear as repeated small connections, unusual DNS activity, or contacts with known malicious destinations. Endpoint evidence and threat intelligence strengthen the finding.
Possible exfiltration includes unexpected uploads, transfers outside normal hours, sensitive systems sending to unapproved destinations, or compressed data leaving through an unusual service.
Monitoring gaps—logs stopping, time stamps drifting, agents going offline, or configurations changing without approval—can hide activity and deserve prompt review.
Corroboration makes an alert stronger
One failed login is common. Hundreds of failures followed by a successful login from a new device, a privilege change, and a large outbound transfer form a much stronger pattern. Defenders build a timeline and check independent sources.
Logs, sensors, and monitoring systems
Each source answers different questions. Accurate time synchronization, appropriate retention, access controls, and protection from alteration make logs more trustworthy.
| Evidence source | What it can show | Important limitation |
|---|---|---|
| Network and flow logs | Who communicated with whom, when, for how long, and approximately how much data moved. | Metadata may not reveal encrypted content or the user’s intent. |
| Firewall logs | Allowed and denied connections, rule matches, sources, destinations, ports, and sometimes applications. | A permitted connection can still carry harmful activity. |
| Authentication logs | Successes, failures, MFA events, device or location context, account lockouts, and privilege changes. | A stolen valid account may appear legitimate without behavioral context. |
| Access and cloud audit records | Administrative actions, file access, resource changes, API calls, and account activity. | Coverage and detail depend on configuration and service capabilities. |
| IDS / IPS alerts | Known threat patterns, policy violations, protocol anomalies, or unusual behavior. | Alerts can be wrong or incomplete and require validation. |
| Device and wireless inventory | Expected hardware, IP and MAC associations, approved access points, and new arrivals. | Stale inventories make legitimate devices look suspicious. |
Intrusion detection system (IDS)
Monitors selected activity and generates alerts for investigation. A network IDS is commonly positioned where it can observe relevant traffic but usually does not block traffic by itself.
Intrusion prevention system (IPS)
Can detect and take an automated action, such as blocking a connection, when policy permits. Because a mistaken block can interrupt legitimate work, tuning and oversight matter.
SIEM
A security information and event management system collects and correlates events from multiple sources, applies rules or analytics, builds timelines, and helps analysts prioritize investigations.
Signature, anomaly, and behavioral detection
Looks for known patterns
A signature describes characteristics associated with a known threat or prohibited event. It can be precise and explainable, but may miss new or meaningfully changed activity. Signatures require trusted updates and careful tuning.
Looks for deviations from a baseline
Anomaly detection compares current activity with expected behavior for users, devices, connections, or applications. It can surface unfamiliar threats, but legitimate changes can cause extra alerts.
Network traffic analysis
Defenders examine packet and flow metadata such as source and destination, port, protocol, time, duration, direction, volume, and connection state. Authorized packet-content inspection may add context, but encryption, privacy, storage, and legal requirements limit visibility.
Behavioral monitoring
Analytics compare activity over time: which services a server usually contacts, when a user typically signs in, or how much data a device normally sends. Baselines must be reviewed as schedules, systems, and legitimate use change.
False positives, false negatives, and priority
| Outcome | Meaning | Defensive response |
|---|---|---|
| True positive | The tool alerts and suspicious activity is genuinely present. | Follow the incident process; preserve evidence and coordinate response. |
| False positive | The tool alerts, but the activity is legitimate. | Document why, tune carefully, and preserve coverage for real threats. |
| True negative | Normal activity occurs and no alert is produced. | Continue monitoring and periodically test detection coverage. |
| False negative | Malicious activity occurs without a useful alert. | Learn from the gap and improve visibility, rules, baselines, or controls. |
Priority is contextual: confidence × likely impact × asset importance × urgency. A medium-confidence alert involving an administrator account or critical server may outrank a high-confidence but low-impact policy event.
From alert to safe response
Automated tools provide scale and speed; people contribute context, authorization, ethical judgment, communication, and accountability. Use the organization’s incident-response plan rather than improvising.
- ObserveDo not interact with suspicious systems unnecessarily. Note what the alert or user report actually says.
- DocumentRecord time, system, source, alert ID, observable behavior, and actions already taken. Preserve original evidence.
- ValidateCheck asset ownership, approved changes, baselines, related logs, and independent alerts within your role.
- EscalateUse the approved channel and give the security or IT team concise facts. Treat sensitive details appropriately.
- CoordinateAuthorized responders contain, investigate, recover, and improve controls while maintaining a decision timeline.
Useful report
“At 10:42, monitoring alert 1842 showed repeated failed logins for the library server followed by a success from a new device. No maintenance is listed. I preserved the alert and notified the service desk.”
Avoid uncoordinated action
Do not delete logs, shut down critical systems, confront a suspected person, publicly share indicators, or block infrastructure unless the response plan and an authorized decision-maker direct it.
Detection decisions in the real world
Home
A router lists a device the family does not recognize. First compare it with the household inventory and guest devices; then use the router provider’s safe support guidance or an authorized adult’s account to review access.
School
Wireless monitoring reports an unknown access point using a name similar to the school network. A student reports the name and location to IT instead of connecting, investigating, or unplugging equipment.
Office
A staff account has many failures, a success from a new location, and a large cloud download. The analyst correlates identity, endpoint, and cloud logs, checks approved travel, and escalates based on account privilege and data sensitivity.
Data center
A public service slows while traffic rises from many sources. Operations checks capacity and health while the security team compares flow, firewall, and service logs to distinguish demand, failure, and possible DDoS activity.
Cloud network
An application workload begins contacting a destination it has never used. Cloud flow logs, workload identity, change records, DNS logs, and threat intelligence help determine whether this is a deployment change or possible compromise.
Shared lesson
No single clue tells the whole story. Inventory, baselines, logs, people, and documented response procedures turn isolated observations into reliable decisions.
Watch: detecting network threats
Use the video to reinforce the lesson. While watching, list one data source, one warning sign, and one reason human validation matters.
Interactive knowledge check
Signal Sleuth
Choose the strongest defensive answer. The quiz works in your browser and collects no personal information.
What the quiz covers
Normal activity and baselines; IOCs; traffic, identity, wireless, DoS/DDoS, malware, and exfiltration clues; logs; IDS and IPS; SIEM; signature and anomaly detection; alert quality; and safe reporting.
How scoring works
There are 10 questions worth one point each. Answer every question, select Check my answers, read each explanation, and restart whenever you want another attempt.
AP® Cybersecurity study support
Baseline
A description of expected activity used for comparison.
IOC
Observable evidence that may be associated with compromise.
Telemetry
Measurements and event data collected from systems or networks.
Correlation
Connecting related events across sources, systems, or time.
Beaconing
Repeated, patterned communication that may merit investigation.
Exfiltration
Unauthorized transfer of data out of a protected environment.
Exam reasoning pattern
Name the evidence source, compare activity with the baseline or signature, add asset and user context, consider an innocent explanation, correlate another source, then choose a safe authorized response.
Continue studying
Explore RevisionTown computer science resources, connect encrypted traffic to the cryptography guide, or strengthen revision habits with the AP® self-study guide.
Frequently asked questions
1. What is network attack detection?
It is the collection and analysis of network, identity, system, and security evidence to identify activity that may represent an attack or policy violation and route it for authorized investigation and response.
2. Is unusual network activity always malicious?
No. Software updates, special events, travel, backups, new devices, and configuration changes can all look unusual. Analysts verify context and correlate evidence before deciding.
3. What is an indicator of compromise?
An IOC is observable evidence potentially connected to compromise, such as a known-malicious destination or an unexpected account change. It is a clue whose meaning depends on context and reliability.
4. What is the difference between an IDS and an IPS?
An IDS detects and alerts on selected activity. An IPS can also take an automated preventive action, such as blocking a connection, when policy and placement allow it.
5. How do signature-based and anomaly-based detection differ?
Signature detection looks for known patterns. Anomaly detection looks for meaningful departures from an established baseline. Most mature programs combine multiple methods.
6. What does a SIEM do?
A SIEM centralizes and correlates event data from multiple sources, applies detection logic, supports alert prioritization, and helps analysts build investigation timelines.
7. What is a false positive?
It is an alert that incorrectly identifies legitimate activity as suspicious. Excessive false positives consume analyst time, but careless tuning can create dangerous blind spots.
8. Can encrypted traffic still be monitored?
Often, useful metadata remains visible, including endpoints, time, duration, volume, and connection behavior. Content visibility depends on architecture, authorization, technology, privacy, and legal requirements.
9. What should I do if I see an unknown device on a network?
Record what you observed and report it to the network owner or approved support channel. Do not connect to, scan, disconnect, or confront the device without authorization.
10. Why is human investigation still necessary?
Tools process large amounts of data quickly, but people interpret business context, validate evidence, weigh consequences, coordinate communication, and authorize proportionate actions.
Trusted references
AP® is a trademark registered by the College Board, which is not affiliated with and does not endorse this page. This lesson provides defensive cybersecurity education. Network monitoring, evidence collection, investigation, and response must be authorized and follow applicable policies, privacy requirements, and law.
