Definition
Network Intrusion Analysis is the process of examining network traffic and logs to detect and investigate suspicious or malicious activity. It involves identifying patterns, anomalies, and indicators of compromise that suggest a security breach or policy violation has occurred or is in progress. This analysis is crucial for understanding the scope of an attack, identifying the methods used by attackers, and gathering evidence for incident response and forensic investigations. For instance, analyzing unusual outbound traffic from a server might reveal data exfiltration. It differs from simple intrusion detection, which focuses on alerting, by delving deeper into the 'why' and 'how' of an event. Network Intrusion Analysis is a key skill tested on certifications like CompTIA Security+ and CISSP.