A security operations team wants to establish a baseline for 'normal' DNS query rates per workstation to detect DNS tunneling. Which statistical approach is most appropriate for anomaly detection?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because per-host statistical baselining (mean ± N standard deviations) accounts for the natural variation between workstations (a developer's laptop vs. a kiosk) and detects relative anomalies rather than absolute thresholds that may miss low-and-slow tunneling or over-alert on power users.
Full explanation below image
Full Explanation
B is correct because per-host statistical baselining (mean ± N standard deviations) accounts for the natural variation between workstations (a developer's laptop vs. a kiosk) and detects relative anomalies rather than absolute thresholds that may miss low-and-slow tunneling or over-alert on power users. A is wrong because a universal static threshold generates false positives on high-usage hosts and misses tunneling on low-usage hosts. C is wrong because org-wide daily totals mask individual host behavior. D is wrong because many legitimate domains have subdomains exceeding 10 characters; this threshold would generate massive false positives.