Time Signature Based Matching for Data Fusion and Coordination Detection in Cyber Relevant Logs
Explore a methodology for detecting automated behavior in cyber-relevant log data through time signature-based matching in this 23-minute conference talk. Learn how to identify temporal patterns that indicate malicious activity executed by scripts or bots, and discover a scalable approach using locality sensitive hashing to overcome the limitations of brute force methods. Examine the potential applications of this coordination detection methodology, including developing features for anomaly detection, characterizing automated behavior through unsupervised clustering, and fusing disparate data sources using temporal signature keys. Gain insights from examples using a dataset of billions of netflow records, and understand how this approach can enhance network defense capabilities in the context of DARPA's Network Defense program.