Downloaded 17 times
![Exhibit A
CVE-2011-3192 - “Apache Killer”
auxiliary/dos/http/apache_range_dos 2011-08-19
normal Apache Range header DoS (Apache Killer)
Snort 1:19825
/Ranges*x3As*bytes=([dx2D]+x2C){50}/Hsmi
/Ranges*x3As*bytes=([dx2D]+[x2Cs]*){50}/
Hsmi](https://image.slidesharecdn.com/auscert-findingneedlesinhaystacks-130523003806-phpapp01/75/Auscert-Finding-needles-in-haystacks-the-size-of-countries-6-2048.jpg)
Auscert Finding needles in haystacks (the size of countries)
- 1. Michael Baker @cloudjunky AusCERT -May 2013 Finding Needles in Haystacks (the size of countries)
- 2. Me Michael Baker CTO andCo-Founder of Packetloop. Pioneering Big Data Security Analytics. Spoken at Black Hat and Ruxcon. http://bitly.com/bundles/packetloop/1
- 3. “We build toys.Some of those toys change the world” - Nicholas Taleb
- 5. Uncertainty Risk you can’tmeasure. Castles, Casinos,War Zones. Let’s get Bayesian (H|E). Industry suffering from overfit. Signatures, limited data, work once.
- 6. Exhibit A CVE-2011-3192 -“Apache Killer” auxiliary/dos/http/apache_range_dos 2011-08-19 normal Apache Range header DoS (Apache Killer) Snort 1:19825 /Ranges*x3As*bytes=([dx2D]+x2C){50}/Hsmi /Ranges*x3As*bytes=([dx2D]+[x2Cs]*){50}/ Hsmi
- 7.
- 8.
- 9.
- 10. Detection is thekey.
- 11. Prevention is thegoal.
- 12. The Big DataPromise* Full fidelity, higher accuracy, no aggregation, size and scale. Model complexity. Apply real science to the problem. “There are more chess games than the number of atoms in the universe” Diego Rasskin Gutman Induction and the Turkey Problem.
- 13.
- 14. APT1 Kill Chain Malwarelink or executable sent to target. (Spearfish or watering hole). Malware executed. Establish Command and Control. Lateral movement through privilege escalation. Data Compressed and Exfiltrated.
- 15. Invasion Games Attackers vsDefenders. Attackers looking to stretch, avoid, challenge defensive lines to achieve their goal. Security is a contact sport. Manipulate Time and Space. Win collisions.
- 16.
- 17.
- 18. Big Data SecurityAnalytics Size and Scale Visualization Fidelity Interaction Outlier Detection Attacker Profiling Enrichment Transform Prediction and Probability Intelligence sharing Statistical Analysis Feature Extraction Machine Learning Kill Chain Disruption
- 19.
- 20. Network Streams Complete recordof all network data. Provides the highest fidelity to analysts. Only way to really understand subtle, targeted attacks. Play, pause and rewind your network. No need to have a specific logging setup. Dense feature space.
- 21. “The difficulty shiftsfrom traffic collection to traffic analysis. If you can store hundreds of gigabytes of traffic per day, how do you make sense of it?” - Richard Bejtlich
- 22.
- 23.
- 24. It’s all aboutContext.
- 25. Context Enriched information, notjust IP Addresses. Additional intelligence on attackers. Allow you to perform detective work. What if? Branch analysis and exploring data. Providing full fidelity and full context quickly.
- 26.
- 27.
- 28.
- 29.
- 30.
- 31.
- 32. Anscombe’s Quartet II IIIIIIIIII IVIV x y x y x y x y 0.0 8.04 10.0 9.14 10.0 7.46 8.0 6.58 8.0 6.95 8.0 8.14 8.0 6.77 8.0 5.76 13.0 7.58 13.0 8.74 13.0 12.74 8.0 7.71 9.0 8.81 9.0 8.77 9.0 7.11 8.0 8.84 11.0 8.33 11.0 9.26 11.0 7.81 8.0 8.47 14.0 9.96 14.0 8.10 14.0 8.84 8.0 7.04 6.0 7.24 6.0 6.13 6.0 6.08 8.0 5.25 4.0 4.26 4.0 3.10 4.0 5.39 19.0 12.50 12.0 10.84 12.0 9.13 12.0 8.15 8.0 5.56 7.0 4.82 7.0 7.26 7.0 6.42 8.0 7.91 5.0 5.68 5.0 4.74 5.0 5.73 8.0 6.89 Source:Wikipedia http://bit.ly/110Se5y
- 33. Anscombe’s Quartet Source: visual.ly- http://bit.ly/105BcEI
- 34. Full HD Play, Pause,Rewind
- 35.
- 36.
- 37.
- 38.
- 40. Bias Collisions Producing informationas it arrives in the stream. Yaraprocessor Chopshop Enrich as much information as possible. What’s the probability of the event?
- 41.
- 42.
- 43. Machine Learning High dimensionalfeature space. Models instead of signatures. Classification (class prediction). Operating system detection. Protocol detection. Finding novelty and outliers. Trained models, real time predictions.
- 44. Related ML Work FrankDenis @jedisct1 Malware vs Big Data Jason Trost @jason_trost and John Munro Large Scale Malicious Domain Classification
- 45.
- 46.
- 47.
- 49.
- 50.
- 51.
- 52.
- 53.
- 54.
- 55. Torrent 1M attacks over12 days. 17 attackers were also downloading torrents. TOR / Torrent are generally mutually exclusive. Good entropy on larger files for changing IPs. Torrent client + UA + OS Classification
- 56. Really? 7 Weeks to100 Push-Ups: Strengthen and SculptYour Arms,Abs, C 1000 Photoshop Tips and Tricks (Dec 2010)-Mantesh Footloose.2011.DVDRip.XviD- PADDO
- 57.
- 58. Half Life ofData Incredibly valuable just after creation. What is the half life of security data? Need to accommodate post hoc delivery of information. Probabilistic models making real time decisions. Full fidelity and long histories for Tactical, Operational and Strategic decisions. Source: Nucleus Research - http://bit.ly/10BRAeZ
- 59. This is notSIEM.
- 60. !SIEM Real time Full Fidelity Exploreand explain the data (evidence). Play, Pause and Rewind. Blink and you miss it technology. No aggregation. No parsers. Frictionless. Clear intelligence. Decision Making Platform.
- 61. One thing wecan count on
- 62. Changing Tactics Kill Chainswill change. Commit, shift, delay defenders. Commit to triaging an event that is not the real event. Shift defenders to locations or targets. Create doubt in defenders to maintain stationary.
- 63.
- 64.