Difference between revisions of "Cybersecurity"
m |
m |
||
| Line 135: | Line 135: | ||
|| | || | ||
<youtube>R9lkyJL2LlQ</youtube> | <youtube>R9lkyJL2LlQ</youtube> | ||
| − | <b> | + | <b>How big data and AI saved the day: critical IP almost walked out the door |
| − | </b><br> | + | </b><br>Cybersecurity threats have evolved beyond what traditional SIEMs and firewalls can detect. We present case studies highlighting how: An advanced manufacturer was able to identify new insider threats, enabling them to protect their IP A media company’s security operations center was able to verify they weren’t the source of a high-profile media leak. The common thread across these real-world case studies is how businesses can expand their threat analysis using security analytics powered by artificial intelligence in a big data environment. Cybersecurity threats increasingly require the aggregation and analysis of multiple data sources. Siloed tools and technologies serve their purpose, but can’t be applied to look across the ever-growing variety and volume of traffic. Big data technologies are a proven solution to aggregating and analyzing data across enormous volumes and varieties of data in a scalable way. However, as security professionals well know, more data doesn’t mean more leads or detection. In fact, all too often more data means slower threat hunting and more missed incidents. The solution is to leverage advanced analytical methods like machine learning. Machine learning is a powerful mathematical approach that can learn patterns in data to identify relevant areas to focus. By applying these methods, we can automatically learn baseline activity and detect deviations across all data sources to flag high-risk entities that behave differently from their peers or past activity. Speaker Roy Wilds Principal Data Scientist Interset |
|} | |} | ||
|<!-- M --> | |<!-- M --> | ||
| Line 143: | Line 143: | ||
|| | || | ||
<youtube>B3ZZWx9WUEk</youtube> | <youtube>B3ZZWx9WUEk</youtube> | ||
| − | <b> | + | <b>Introduction to Graphistry |
| − | </b><br> | + | </b><br>Graphistry transforms the speed and depth of modern investigations. This unique investigation platform allows analysts to bring together all of their tools and data into a single environment where they can see connections, outliers, progression, and scope of security events. Key capabilities include: - Automatically connects and queries across any and all data sources including SIEMs, Spark, Hadoop, threat feeds, or any source with an API. - Displays data as interactive and intuitive graphs that allow analysts to quickly see important connections, follow leads, and pivot to new data sources on the fly. - Allows analysts to save and share complete investigation workflows as Visual Playbooks that can be reused and embedded wherever they are needed. Learn more at http://www.graphistry.com |
|} | |} | ||
|}<!-- B --> | |}<!-- B --> | ||
| Line 152: | Line 152: | ||
|| | || | ||
<youtube>hx1vlorz1w4</youtube> | <youtube>hx1vlorz1w4</youtube> | ||
| − | <b> | + | <b>How the Future of Cybersecurity Depends on AI/ML |
| − | </b><br> | + | </b><br>SparkCognition's Director of Cybersecurity, Rick Pither, discusses the role of artificial intelligence and machine learning in the cyber security landscape. For more information on AI in cybersecurity visit: http://bit.ly/2Vdzj0j |
|} | |} | ||
|<!-- M --> | |<!-- M --> | ||
| Line 160: | Line 160: | ||
|| | || | ||
<youtube>99hniQYB6VM</youtube> | <youtube>99hniQYB6VM</youtube> | ||
| − | <b> | + | <b>Deep Learning For Realtime Malware Detection - Domenic Puzio and Kate Highnam |
| − | </b><br> | + | </b><br>Domain generation algorithm (DGA) malware makes callouts to unique web addresses to avoid detection by static rules engines. To counter this type of malware, we created an ensemble model that analyzes domains and evaluates if they were generated by a machine and thus potentially malicious. The ensemble consists of two deep learning models – a convolutional neural network and a long short-term memory network, both which were built using Keras and Tensorflow. These deep networks are flexible enough to learn complex patterns and do not require manual feature engineering. Deep learning models are also very difficult for malicious actors to reverse engineer, which makes them an ideal fit for cyber security use cases. The last piece of the ensemble is a natural-language processing model to assess whether the words in the domain make sense together. These three models are able to capture the structure and content of a domain, determining whether or not it comes from DGA malware with very high accuracy. These models have already been used to catch malware that vendor tools did not detect. Our system analyzes enterprise-scale network traffic in real time, renders predictions, and raises alerts for cyber security analysts to evaluate. Domenic Puzio is a Data Engineer with Capital One. He graduated from the University of Virginia with degrees in Mathematics and Computer Science. On his current project he is a core developer of a custom platform for ingesting, processing, and analyzing Capital One’s cyber-security data sources. Built entirely from opensource tools (NiFi, Kafka, Storm, Elasticsearch, Kibana), this framework processes hundreds of millions of events per hour. Currently, his focus is on the creation and productionization of machine learning models that provide enrichment to the data being streamed through the system. He is a contributor to two Apache projects. Kate Highnam has a background in Computer Science and Business, focusing on security, embedded devices, and accounting. At the University of Virginia, her thesis was a published industrial research paper containing an attack scenario and repair algorithm for drones deployed on missions with limited ground control contact. After joining Capital One as a Data Engineer, Kate has developed features within an internal DevOps Pipeline and Data Lake governance system. Currently, she builds machine learning models to assist cybersecurity experts and enhance defenses. |
|} | |} | ||
|}<!-- B --> | |}<!-- B --> | ||
Revision as of 19:24, 5 October 2020
Youtube search... ...Google search
- Case Studies
- Capabilities
- Cybersecurity References
- Offense - Adversarial Threats/Attacks
- Cybersecurity Frameworks, Architectures & Roadmaps
- Cybersecurity Companies/Products
- Cybersecurity: National Institute of Standards and Technology (NIST) & U.S. Department of Homeland Security (DHS)
- Defense: Cybersecurity and Acquisition Lifecycle Integration Tool (CALIT)
- Cybersecurity: Evaluating & Selling
- (Artificial) Immune System
- 5G Security
- Useful Models ...find outliers:
- Detecting Malicious Requests with Keras & TensorFlow | Adam Kusey - Medium
- Best security software: How 12 cutting-edge tools tackle today's threats | CSO
- graphistry.com
- Intelligence Advanced Research Projects Activity (IARPA)Is Trying Keep Adversaries From Corrupting AI Tools ... Could cyber adversaries be training the government’s artificial intelligence tools to fail? | Jack Corrigan - Nextgov
- TrojAI - Office of the Director of National Intelligence Office: Intelligence Advanced Research Projects Activity FedBizOpps.gov predict whether AI systems have been corrupted through so-called “Trojan attacks.”
- Adversarial Attacks on Graph Convolutional Network (GCN), Graph Neural Networks (Graph Nets), Geometric Deep Learning
- Breaking Down the Tencent 2018 Cybersecurity Report
- Chronicle combines all the best parts of Google and X culture
- Fraud and Anomaly Detection | Chris Nicholson - A.I. Wiki pathmind
- The Cyber Security Evaluation Tool (CSET®) | National Cybersecurity and Communications Integration Center ...provides a systematic, disciplined, and repeatable approach for evaluating an organization’s security posture
- Watch me Build a Cybersecurity Startup | Siraj Raval
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Fraud Detection
- Introduction to Fraud Detection Systems | Miguel Gonzalez-Fierro, Microsoft
- AI for Health Insurance Fraud Detection – Current Applications | Niccolo Mejia
|
|
|
|
Data Center Security
|
|
|
|
|
|