Главная
Study mode:
on
1
Intro
2
CONTEXT
3
EQL BY EXAMPLE
4
SEQUENCES: ORDER MATTERS
5
THE DREAM: SEMI-AUTOMATIC
6
MACHINE LEARNING ON SEQUENCE DATA
7
MODEL DESIGN: FEATURES
8
MODEL DESIGN: EMBEDDING
9
MODEL DESIGN: RECURRENT
10
MODEL DESIGN: CONVICTION
11
PATTERN EARLINESS?
12
UPDATED MODEL SUMMARY
13
LEARNED PATTERNS?
14
FALSE NEGATIVE
15
FALSE POSITIVE
16
STEP BACK: WHAT HAVE WE DONE?
Description:
Explore advanced techniques for detecting malicious patterns in event-streaming data in this 50-minute conference talk from nullcon Goa 2019. Delve into the challenges of identifying adversarial activity using behavioral indicators rather than static indicators of compromise. Learn about tools for hunting known complex behavioral patterns and discover a deep learning approach for automatically uncovering behavioral patterns from event logs. Gain insights from Hyrum Anderson, Chief Scientist at Endgame, as he discusses the importance of early detection, the use of machine learning on sequence data, and model design considerations including features, embedding, recurrent networks, and conviction patterns. Examine the effectiveness of these methods through analysis of false positives and negatives, and understand the broader implications for information security and situational awareness.

Early Detection of Malicious Patterns in Event-Streaming Data

nullcon
Add to list
0:00 / 0:00