ORIGINAL COMPANY-CONTEXT PRACTICE
Detect unusual network activity without treating every burst as hostile
Original practice scenario: A hypothetical network analytics model sees traffic-volume and protocol changes during software updates. Design an anomaly evaluation that recognizes legitimate operational events.
Written for independent practice using company context; this is not a verified question from a company interview.
A REASONED APPROACH
Model answer.
Distinguish statistical novelty from a confirmed security incident. A large but expected software rollout can be anomalous in volume while remaining legitimate activity.
Work through it
- Define asset and time-window features with source coverage and operational context, avoiding payload collection unless justified and authorized.
- Compare robust seasonal or peer-group baselines with the model using time-separated data and independently reviewed events, retaining unknown outcomes instead of forcing negative labels.
- Measure investigation workload, detection delay and missed-event patterns, testing scheduled deployments, newly added assets and telemetry outages.
Tradeoffs to discuss
- Context-aware suppression reduces noise but may hide malicious activity that coincides with maintenance; transparent reviewable rules are preferable to silent exclusions.
Common pitfalls
- Do not train with incident-resolution fields unavailable when the alert would be raised.
- A high anomaly score should route evidence for review rather than assert malicious intent.