Anomaly detection in SAP systems identifies previously unknown threats and bypasses anti-forensics by establishing profiles of normal user and system behavior. The Cybersecurity Extension for SAP automates this process using machine learning, allowing security administrators to detect outliers that traditional signature-based pattern matching often misses.
Executive Summary
Threat detection has traditionally relied on rules and signature-based pattern matching to identify known exploits. While effective for established threats, pattern matching has critical limitations: attackers can obfuscate their actions to evade detection, and new, emerging threats—for which no signature exists—remain invisible. Anomaly-based threat detection solves these issues by creating behavioral profiles for users and systems. When actions deviate from these established norms, the system triggers an alert. Because maintaining these profiles manually is impossible, the Cybersecurity Extension for SAP leverages machine learning platforms to automate profile building and analysis. By integrating with SAP HANA and the Predictive Analysis Library (PAL), the extension identifies outliers in security logs—such as unusual transaction volumes or logins from new IP addresses—and surfaces them within the SAP Solution Manager. This approach provides a robust, multi-layered defense that complements traditional signature-based security, ensuring broader visibility into both known and unknown attack vectors.
Key Takeaways
- Anomaly detection identifies unknown attacks that bypass signature-based pattern matching.
- Profiles of “normal” behavior are automatically generated using machine learning.
- The Cybersecurity Extension for SAP uses SAP HANA Predictive Analysis Library (PAL) for outlier detection.
- Effective scoring mechanisms are required to manage false positives in anomaly-based systems.
- Anomaly results are viewable within the Fiori launchpad in SAP Solution Manager.
How does anomaly detection differ from pattern matching?
Anomaly detection identifies deviations from expected behavior, whereas pattern matching relies on known signatures of malicious activity. While pattern matching is a tried and tested method for identifying known exploits, it fails to detect new or emerging threats that lack a registered signature. Furthermore, attackers can often obfuscate their actions to bypass specific detection patterns. Anomaly detection provides greater protection against these anti-forensics techniques by flagging any activity that falls outside of established user and system norms.
How does the Cybersecurity Extension for SAP perform anomaly detection?
The Cybersecurity Extension for SAP automates anomaly detection by forwarding event logs collected by Solution Manager to the Predictive Analysis Library (PAL) in SAP HANA. PAL applies complex analytic algorithms—including clustering, regression, and time series analysis—via SQLScript database procedures to identify outliers within security logs. These discovered anomalies are then transmitted back to the Anomaly Detection app, which is accessed from the Fiori launchpad in SAP Solution Manager.
What types of anomalies can be detected?
The system detects anomalies across two primary categories: event data and alert data. Event anomalies include outliers such as high volumes of transaction starts, report starts, or data downloads, as well as user requests originating from new IP addresses or terminals. Alert anomalies focus on broader patterns, such as a high volume of alerts for a specific system, user, or source, or the generation of a new type of alert for a known user or system.
Anomaly results are summarized by period. Results can be analyzed by the week, day or hour.
Results are filtered using Advanced Search. This supports filtering by anomaly, date, time, system, user, and source IP/ terminal. Results can also be filtered by anomaly type to view anomalies based on either event data or alert data.
How are anomalies scored and managed?
Anomalies are scored based on their statistical distance from the mean, with higher confidence levels assigned to events that deviate further from standard averages. Because anomaly detection can generate a higher incidence of false positives than signature-based methods, this scoring mechanism is essential for security administrators to filter out noise and focus on high-confidence threats.
The layout can be personalized by users to add, remove, and rearrange columns.
The details for each anomaly can be viewed by clicking on an anomaly in the summary. The Notify option can be used to append the anomaly details to an email for sharing.
