GIAC Certified Intrusion Analyst (GCIA): key terms

Flashcards for this exam GIAC Certified Intrusion Analyst (GCIA) guide

• Amplification AttackA DDoS technique that sends small spoofed requests to services that return much larger responses to the victim.Intermediate
• Anomaly-Based DetectionDetecting threats by identifying deviations from an established baseline of normal behavior.Foundational
• ARP PoisoningSending forged ARP replies to associate the attacker's MAC address with another host's IP, redirecting LAN traffic.Intermediate
• BeaconingRegular, periodic outbound communication from a compromised host to attacker command-and-control infrastructure.Intermediate
• DNS TunnelingEncoding data or command-and-control traffic inside DNS queries and responses to bypass network controls.Advanced
• Domain Generation Algorithm (DGA)An algorithm in malware that generates many pseudo-random domain names to locate its command-and-control servers.Advanced
• False Negative (FN)A failure to alert on activity that is actually malicious.Foundational
• False Positive (FP)An alert that flags benign activity as malicious.Foundational
• Fast FluxA DNS technique that rapidly changes the IP addresses associated with a domain to hide malicious infrastructure.Advanced
• Full Packet Capture (FPC)Recording complete network packets, including payloads, for detailed analysis and forensics.Intermediate
• IP SpoofingForging the source IP address of packets to hide the sender's identity or impersonate another system.Intermediate
• NetFlowA Cisco-originated technology that exports metadata about traffic flows, such as addresses, ports and byte counts, to a collector.Intermediate
• Network Detection and Response (NDR)A solution that analyzes network traffic to detect threats and enable response, often using behavioral analytics.Intermediate
• Network ForensicsCapturing and analyzing network traffic and logs to investigate security incidents.Intermediate
• Network Traffic Analysis (NTA)Monitoring and analyzing network traffic to detect anomalies, threats and performance issues.Intermediate
• Signature-Based DetectionDetecting threats by matching known patterns, such as file hashes or byte sequences, against a database of signatures.Foundational
• SnortAn open-source network intrusion detection and prevention system using rule-based signature matching, now maintained by Cisco.Intermediate
• SuricataAn open-source, multithreaded intrusion detection and prevention engine and network security monitoring tool.Intermediate
• SYN FloodA DoS attack that sends many TCP SYN packets without completing the handshake, exhausting the server's connection table.Foundational
• tcpdumpA command-line packet capture tool for Unix-like systems.Intermediate
• True Positive (TP)An alert that correctly identifies real malicious activity.Foundational
• WiresharkA free, open-source graphical protocol analyzer that captures and decodes network packets.Foundational
• ZeekAn open-source network security monitoring tool that generates detailed logs of network protocol activity.Intermediate