![PointerToRawData:
0x2000
PointerToRelocations: 0x0
PointerToLinenumbers: 0x0
NumberOfRelocations: 0x0
NumberOfLinenumbers:
0x0
Characteristics:
0xC0000040
Flags: MEM_WRITE,
CNT_INITIALIZED_DATA,
MEM_READ
Entropy: 7.980693 (Min=0.0,
Max=8.0)
[IMAGE_SECTION_HEADER]
Name: NicolasB
Misc: 0x1000
Misc_PhysicalAddress:
0x1000
Misc_VirtualSize: 0x1000
VirtualAddress:
0x47000
SizeOfRawData:
0xEFEFADFF
PointerToRawData:
0x47000
PointerToRelocations: 0x0
PointerToLinenumbers: 0x0
...
----------PE Sections----------
[IMAGE_SECTION_HEADER]
Name: CODE
Misc: 0x1000
Misc_PhysicalAddress:
0x1000
Misc_VirtualSize: 0x1000
VirtualAddress: 0x1000
SizeOfRawData: 0x1000
PointerToRawData: 0x1000
PointerToRelocations: 0x0
PointerToLinenumbers: 0x0
NumberOfRelocations: 0x0
NumberOfLinenumbers: 0x0
Characteristics:
0xE0000020
Flags: MEM_WRITE, CNT_CODE,
MEM_EXECUTE, MEM_READ
Entropy: 0.061089 (Min=0.0,
Max=8.0)
[IMAGE_SECTION_HEADER]
Name: DATA
Misc: 0x45000
Misc_PhysicalAddress:
0x45000
Misc_VirtualSize: 0x45000
VirtualAddress: 0x2000
SizeOfRawData: 0x45000
----------FILE_HEADER----------
[IMAGE_FILE_HEADER]
Machine: 0x14C
NumberOfSections: 0x4
TimeDateStamp: 0x851C3163
[INVALID TIME]
PointerToSymbolTable:
0x74726144
NumberOfSymbols: 0x455068
SizeOfOptionalHeader: 0xE0
Characteristics: 0x818F
----------OPTIONAL_HEADER----------
[IMAGE_OPTIONAL_HEADER]
Magic: 0x10B
MajorLinkerVersion: 0x2
MinorLinkerVersion: 0x19
SizeOfCode: 0x200
SizeOfInitializedData: 0x45400
SizeOfUninitializedData: 0x0
AddressOfEntryPoint: 0x2000
BaseOfCode: 0x1000
BaseOfData: 0x2000
ImageBase: 0xDE0000
SectionAlignment: 0x1000
FileAlignment: 0x1000
MajorOperatingSystemVersion: 0x1
MinorOperatingSystemVersion: 0x0
----------Parsing Warnings----------
Suspicious NumberOfRvaAndSizes in
the Optional Header. Normal values are
never larger than 0x10, the value is:
0xdfffddde
Error parsing section 2. SizeOfRawData
is larger than file.
----------DOS_HEADER----------
[IMAGE_DOS_HEADER]
e_magic: 0x5A4D
e_cblp: 0x50
e_cp: 0x2
----------NT_HEADERS----------
[IMAGE_NT_HEADERS]
Signature: 0x4550
pefile dump
46](https://image.slidesharecdn.com/mlsec-170601083355/85/slide-46-320.jpg)
Uploaded byPositive Hack Days
Практическое применение машинного обучения в ИБ
The document discusses practical applications of machine learning in information security, touching on various tools like scikit-learn and TensorFlow for implementing machine learning algorithms. It covers fundamental concepts such as classifiers, regression, and anomaly detection alongside hands-on exercises for real-world applications. Additionally, it provides insights into different machine learning techniques including classification methods and the analysis of malware characteristics.
More Related Content
Similar to Практическое применение машинного обучения в ИБ
![[Eestec] Machine Learning online seminar 1, 12 2016](https://cdn.slidesharecdn.com/ss_thumbnails/eestecmachinelearningseminar1122016offline-161222133213-thumbnail.jpg?width=640&height=640&fit=bounds)
Практическое применение машинного обучения в ИБ
- 1.
- 2.
- 3.
- 4.
- 5.
- 6.
- 7. Python toolKits 7 ● Scikit-Learn- Python library that implements a range of machine learning algos and helpers ● TensorFlow - library for numerical computation using data flow graphs / deep learning
- 8. scikit-learn 8 ● easy-to-use, general-purposetoolbox for machine learning in Python. ● supervised and unsupervised machine learning techniques. ● Utilities for common tasks such as model selection, feature extraction, and feature selection ● Built on NumPy, SciPy, and matplotlib ● Open source, commercially usable - BSD license
- 9. Tensorflow 9 ● Open source ●By Google ● used for both research and production ● Used widely for deep learning/neural nets ○ But not restricted to just deep models ● Multiple GPU Support
- 10.
- 11. Basic terms 11 Classifier "An algorithmthat implements classification, especially in a concrete implementation, is known as a classifier. The term "classifier" sometimes also refers to the mathematical function, implemented by a classification algorithm, that maps input data to a category." Model Linear regression algorithm is a technique to fit points to a line y = m x+c. Now after fitting, you get for example, y = 10 x + 4. This a model. A model is something to which when you give an input, gives an output. In ML, any 'object' created after training from an ML algorithm is a model. Linear Regression Fitting a linear relationship b/w two quantitative variables
- 12.
- 13.
- 14. MACHINE LEARNING 101 14 Typesof machine learning use cases: ● Regression ● Classification ● Anomaly detection ● Recommendation won’t cover here, but check out this talk This covers EVERYTHING.(almost) supervised unsupervised
- 15.
- 16. Regression ● regression =finding relationships between variables Training data Regression learning algorithm Regression model/function Size of population Profit 16
- 17. Linear Regression 17 regression line 2dlinear regression
- 18.
- 19. Model optimization -Gradient descent 19 success
- 20. Model optimization -Gradient descent 20 failure
- 21. 21 Hands-on Linear/Logistic Regression ● /home/ml/Desktop/intro/00-linear-regression.ipynb ●/home/ml/Desktop/intro/01-logistic-regression.ipynb
- 22.
- 23.
- 24. Anomaly detection ● Outliersvs. novelties ○ novelties: unobserved pattern in new observations not included in training data ● Simple statistics/forecasting methods ○ Exponential smoothing, Holt-Winters algorithm ● Machine learning methods ○ Elliptical envelope, density-based, clustering, SVM 24
- 25. 25 Hands-on Anomaly Detection ● /home/ml/Desktop/intro/02-anomaly-detection.ipynb ●/home/ml/Desktop/anomaly/anomaly-detection-eg.ipynb
- 26.
- 27. 27 labeled data -do you have it? Classification
- 28.
- 29. Supervised classification ● Manydifferent algorithms! ● We will go through five: ○ Naive Bayes ○ K-nearest neighbors ○ Support Vector Machines ○ Decision Trees 29
- 30. Bayes Theorem 30 the probabilityof an event happening is based on prior knowledge of conditions that might be related to the event
- 31. Naive Bayes classifier 31 ●SUPERVISED LEARNING
- 32.
- 33. The dataset: 2007TREC Public Spam Corpus 33 http://plg.uwaterloo.ca/~gvcormac/treccorpus07/ add info about dataset
- 34. Multiclass classification 34 2 waysto do it: ● 1-vs-rest ○ 1 binary classifier per class ● 1-vs-1 ○ 1 binary classifier per pair of classes ○ K*(K−1)/2 classifiers for a K-class problem
- 35. K-Nearest Neighbors classifier(kNN) 35 ● SUPERVISED LEARNING
- 36. Support Vector Machines(SVM) 36 ● /home/ml/Desktop/intro/03-svm.ipynb
- 37. Decision Tree classifier 37 ●SUPERVISED LEARNING visualization
- 38. Unsupervised classification 38 ● Mainlyrefers to clustering ● Four types: ○ Centroid: K-Means ○ Distribution: Gaussian mixture models ○ Density: DBSCAN ○ Connectivity: Hierarchical clustering
- 39. K-Means clustering 39 ● UNSUPERVISEDLEARNING ● /home/ml/Desktop/intro/04-kmeans-pca.ipynb
- 40. SO MANY ALGORITHMS. HOWTO PICK.???????? 40
- 41.
- 42. 42 XSS detectionHANDS ON ●/home/ml/Desktop/waf
- 43. 43 classifying packetsHANDS ON ●/home/ml/Desktop/network/kdd-packet-classification.ipynb dataset
- 44. 44 classifying malware(with staticPE features) HANDS ON ● /home/ml/Desktop/malware
- 45.
- 46. PointerToRawData: 0x2000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations:0x0 NumberOfLinenumbers: 0x0 Characteristics: 0xC0000040 Flags: MEM_WRITE, CNT_INITIALIZED_DATA, MEM_READ Entropy: 7.980693 (Min=0.0, Max=8.0) [IMAGE_SECTION_HEADER] Name: NicolasB Misc: 0x1000 Misc_PhysicalAddress: 0x1000 Misc_VirtualSize: 0x1000 VirtualAddress: 0x47000 SizeOfRawData: 0xEFEFADFF PointerToRawData: 0x47000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 ... ----------PE Sections---------- [IMAGE_SECTION_HEADER] Name: CODE Misc: 0x1000 Misc_PhysicalAddress: 0x1000 Misc_VirtualSize: 0x1000 VirtualAddress: 0x1000 SizeOfRawData: 0x1000 PointerToRawData: 0x1000 PointerToRelocations: 0x0 PointerToLinenumbers: 0x0 NumberOfRelocations: 0x0 NumberOfLinenumbers: 0x0 Characteristics: 0xE0000020 Flags: MEM_WRITE, CNT_CODE, MEM_EXECUTE, MEM_READ Entropy: 0.061089 (Min=0.0, Max=8.0) [IMAGE_SECTION_HEADER] Name: DATA Misc: 0x45000 Misc_PhysicalAddress: 0x45000 Misc_VirtualSize: 0x45000 VirtualAddress: 0x2000 SizeOfRawData: 0x45000 ----------FILE_HEADER---------- [IMAGE_FILE_HEADER] Machine: 0x14C NumberOfSections: 0x4 TimeDateStamp: 0x851C3163 [INVALID TIME] PointerToSymbolTable: 0x74726144 NumberOfSymbols: 0x455068 SizeOfOptionalHeader: 0xE0 Characteristics: 0x818F ----------OPTIONAL_HEADER---------- [IMAGE_OPTIONAL_HEADER] Magic: 0x10B MajorLinkerVersion: 0x2 MinorLinkerVersion: 0x19 SizeOfCode: 0x200 SizeOfInitializedData: 0x45400 SizeOfUninitializedData: 0x0 AddressOfEntryPoint: 0x2000 BaseOfCode: 0x1000 BaseOfData: 0x2000 ImageBase: 0xDE0000 SectionAlignment: 0x1000 FileAlignment: 0x1000 MajorOperatingSystemVersion: 0x1 MinorOperatingSystemVersion: 0x0 ----------Parsing Warnings---------- Suspicious NumberOfRvaAndSizes in the Optional Header. Normal values are never larger than 0x10, the value is: 0xdfffddde Error parsing section 2. SizeOfRawData is larger than file. ----------DOS_HEADER---------- [IMAGE_DOS_HEADER] e_magic: 0x5A4D e_cblp: 0x50 e_cp: 0x2 ----------NT_HEADERS---------- [IMAGE_NT_HEADERS] Signature: 0x4550 pefile dump 46
- 47.
- 48.
- 49. THANKS @cchio sign up forupdates! mlsec@cs.stanford.edu https://www.amazon.com/Machine-Learning-Security- Protecting-Algorithms/dp/1491979909