PCR-Based Network Anomaly Detection

Network Anomaly feature detects abnormally large amounts of data flowing into or out of the workloads based on the concept of Producer Consumer Ratio (PCR). The PCR is defined as:

Egress app byte count - Ingress app byte count
  PCR = ----------------------------------------------
        Egress app byte count + Ingress app byte count

The value of PCR is in the [-1.0, 1.0] range where:

• PCR = 1.0 means the workload purely sends data out.

• PCR = -1.0 means the workload purely receives data.

• PCR = 0.0 means the workload has balanced amounts of data in and data out.

Similar to other Forensics features, you can use the intent-based configuration to configure the Network Anomaly events you want to record and/or alert. Detected Network Anomaly events from workloads are exported every 5 minutes and are matched against configured rules 5 minutes later. As a result, new Network Anomaly events are only observed on the UI every 5 minutes with delay of up to 10 minutes from the time of the event.

In 3.2 and 3.1 versions of Secure Workload software, Network Anomaly detection was known as Data Leak detection.