Big Brother Vs. Big Data: Privacy-Preserving Threat Analytics at Scale
•Download as PPTX, PDF•
3 likes•1,430 views
The cyber-security threat landscape is a faceless whirlwind of deliberate and persistent attempts to compromise individual and organizational data toward nefarious ends. We might not know the direction of the next threat, but we certainly know it is inevitable. All organizations are faced with the massive problem of evolving threat; however, due to the current drought of cyber-security and data science professionals this problem can be prohibitively expensive to solve in isolation. In the absence of shared intelligence, best efforts can lead to ineffective ad-hoc security systems which are only token in nature. The dichotomy is as such: hackers and cyber-criminals can share intelligence for their purposes; how can we leverage and share intelligence about these common threats without compromising the data integrity of each organization? How do we detect advanced persistent threats without violating the privacy rights of individual users? In this talk, we discuss the state of the science in privacy-preserving threat analytics scaled to massive data sets and propose a solution to this dichotomy.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Big Brother Vs. Big Data: Privacy-Preserving Threat Analytics at Scale
Similar to Big Brother Vs. Big Data: Privacy-Preserving Threat Analytics at Scale (20)
Recently uploaded
Recently uploaded (20)
Big Brother Vs. Big Data: Privacy-Preserving Threat Analytics at Scale
- 1. Big Data vs. Big Brother: Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC Privacy-Preserving Advanced Threat Analytics at Scale Chester Parrott, Data Scientist, Cisco ATA PhD Student, LSU
- 2. Research ML/DM/AI Security Game Theory Graph Theory Anomaly Detection Access Control Automated Testing System Simulation Stochastic Models Software Engineering Scalable Data Platforms Background Skillset Application
- 3. Work Research • Threats • Models • Algorithms Prototype • Threats • Algorithms • Systems Weaponize • Systems • Architecture • Algorithms Managed Security Services Advanced Threat Analytics
- 4. Conway’s Data Science Venn Diagram Credit: http://drewconway.com/zia/2013/3/26/the-data-science-venn-diagram
- 5. Joel Grus’ Post-Prism Data Science Venn Diagram Credit: http://joelgrus.com/2013/06/09/post-prism-data-science-venn-diagram/
- 9. Unbalanced between two extremes Credit: http://ecx.images-amazon.com/images/I/51se5x3zlxL.jpg http://blog.gabrielsaldana.org/how-orwells-1984-novel-is-very-accurate-for-2013
- 10. Necessity is the mother of reinvention Credit: http://i.stack.imgur.com/9eHIv.png
- 11. Lack of communication Credit: http://rhinestonearmadillo.typepad.com/the_rhinestone_bookmark/2013/04/the-blind-men-and-the-elephant-fairy-tale-art.html
- 12. Data Anonymization Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC How should we anonymize data *without losing their multi-variate statistical significance?
- 14. Anonymization vs. Summarization Anonymization D Transformation M1 M2 M3 … Pipeline D’ Lab Analysis
- 15. Modern Methods of Data Summarization Generalization 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 ObservableVariable1 Observable Variable 2 Comparison of Observable Values
- 16. If it has webbed feet like a duck, has a bill like a duck, eats the same things as a duck, it is probably…
- 17. You know you meant to say platypus…
- 18. Classical Methods of Data Anonymization Redaction Credit: https://nsarchive.wordpress.com/2010/07/23/what-if-nixon-had-become-a-g-man/ http://versewisconsin.org/wiprotests/media/redactGovernorWalker.png
- 19. Classical Methods of Data Anonymization Encryption Ciphertext Encryption Method Plaintext Key Plaintext Decryption Method Ciphertext Key Transmission Encryption Decryption
- 20. Classical Methods of Data Anonymization Steganography Credit: http://opticalengineering.spiedigitallibrary.org/article.aspx?articleid=1096199
- 21. Modern Methods of Data Anonymization Perturbation Credit: http://dsp.stackexchange.com/questions/24430/generate-fourier-transform-signal 0 5 10 15 20 25 30 35 Observation1 Observation3 Observation5 Observation7 Observation9 Observation11 Observation13 Observation15 Observation17 Observation19 Observation21 Observation23 Observation25 Observation27 Observation29 Perturbed Original Linear (Perturbed)
- 22. Modern Methods of Data Anonymization/Summarization (not covered here) • Anonymization • k-anonymity and l-diversity • Generalization and suppression • Condensation • Blocking based technique • Value class membership and distorted value • Distributed privacy preservation • Summarization • Association rules • Decision trees • MixSim • Stat Tests • Other classifiers Credit: https://carlsimmonslive.files.wordpress.com/2012/01/overstuffed-suitcase1.jpg
- 23. Data Modern Methods of Data Anonymization Substitution Substitution Map DATA’
- 24. Substitution Mapping Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC How should we anonymize data using substitution?
- 25. Modern Methods of Data Anonymization Substitution SourceIP DestIP SourcePort DestPort Protocol 192.168.1.5 172.158.42.12 80 80 HTTP Type InputValue OutputValue IP 192.168.1.5 A IP 192.168.1.34 B Port 80 48 SourceIP DestIP SourcePort DestPort Protocol A C 48 48 HTTP DATA SCALABLE SUBSTITUTION MAP DATA’
- 26. Modern Methods of Data Anonymization Substitution SourceIP DestIP SourcePort DestPort Protocol 192.168.1.5 172.158.42.12 80 80 HTTP Type InputValue OutputValue IP 192.168.1.5 A IP 192.168.1.34 B Port 80 48 SourceIP DestIP SourcePort DestPort Protocol A C 48 48 HTTP DATA SCALABLE SUBSTITUTION MAP DATA’
- 27. Modern Methods of Data Anonymization Substitution ID Height (cm) Weight (kg) Salary (USD) Age 1440788848 180 80 $18,000 23 Unit ScalingValue cm 0.25 kg 10.00 USD 0.6734 Year 0.20 ID Height (cm) Weight (kg) Salary Age A 45 800 12121.2 4.6 DATA SCALABLE SUBSTITUTION MAP DATA’
- 28. Modern Methods of Data Anonymization Substitution ID Height (cm) Weight (kg) Salary (USD) Age 1440788848 180 80 $18,000 23 Unit ScalingValue cm 0.25 kg 10.00 USD 0.6734 Year 0.20 ID Height (cm) Weight (kg) Salary Age A 45 800 12121.2 4.6 DATA SCALABLE SUBSTITUTION MAP DATA’
- 29. Why does this work? 0 20 40 60 80 100 120 140 Corolla Wrangler F150 Prius Units Sold FY2014 Q1 Q2 Q3 Q4
- 30. Why does this work? 0 0.1 0.2 0.3 0.4 0.5 0.6 Product A Product B Product C Product D Units Sold FY2014 Q1 Q2 Q3 Q4
- 31. Why does this work? 0 20 40 60 80 100 120 140 Units Sold FY2014 Q1 Q2 Q3 Q4 0 0.1 0.2 0.3 0.4 0.5 0.6 Product A Product B Product C Product D Units Sold FY2014 Q1 Q2 Q3 Q4
- 32. Why does this work? 0 20 40 60 80 100 120 140 Research Papers Started FY2014 Q1 Q2 Q3 Q4 0 0.1 0.2 0.3 0.4 0.5 0.6 Research Papers Started FY2014 Q1 Q2 Q3 Q4
- 33. Scalable Substitution Mapping Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC How should we anonymize data using substitution *in a way which horizontally scales?
- 34. Modern Methods of Data Anonymization Substitution Data SSM Data’Data’
- 35. Modern Methods of Data Anonymization Substitution Data D1 SSM1 D2 SSM2 D3 SSM3 … … Dn SSMn Data’
- 36. Modern Methods of Data Anonymization Substitution … SSM1 SSM2SSMn Paxos Algorithm
- 37. What can we do with anonymized data? • Exploratory Analysis/Statistical Analysis • Clustering/Linear Regression • Decision Trees/Random Forests • Perceptrons/Neural Networks/Deep Learning • Support Vector Machines • Stochastic Models • ...
- 38. Model Weaponization Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC How should we weaponize models which use anonymized data *in a way which horizontally scales?
- 39. Model Weaponization – Single-Tenant Anonymized Data Customer 1 - n Cisco ATA Research Models Weaponize Models Deploy Models • Boutique machine learning models are trained • Per customer data center • Not shared outside data center • Private data is secure on-premise • Private data used for on-premise models • Models are not scalable
- 40. Model Weaponization – Multi-Tenant Anonymized Data Customer 1 Customer 2 Customer 3 … Customer n Cisco ATA Research Models Weaponize Models Deploy Models • Boutique machine learning models are trained • Per customer data center • Not shared outside data center • Private data is secure on-premise • Anonymized data used for R&D • Multi-tenant anonymized data models • Capitalize on multi-tenant threat landscape
- 42. Further Reading • http://www.cisco.com/web/offers/lp/2015-annual-security-report/index.html • https://www.youtube.com/watch?v=czCuMfFv_lU • https://www.youtube.com/watch?v=YNANI_rPyO4 • https://github.com/tdunning/log-synth • http://ieeexplore.ieee.org/xpl/articleDetails.jsp?arnumber=7097989 • http://www.ermt.net/docs/papers/Volume_4/4_April2015/V4N4-110A.pdf • http://www.biomedcentral.com/content/pdf/s12874-015-0038-6.pdf • http://www.tyronegrandison.org/uploads/1/8/8/1/18817082/ppdm_encyclopedia.pdf • http://www.sans.org/reading-room/whitepapers/vpns/history-encryption-730 • https://equalit.ie/esecman/chapter2_4.html • https://equalit.ie/esecman/chapter2_8.html • http://www.harley.net.au/buscomnet/lectures/lect16.htm • http://ijcsmc.com/docs/papers/April2015/V4I4201599a26.pdf • https://www.cs.sfu.ca/~jpei/publications/SocialNetworkAnonymization_survey.pdf • http://searchsecurity.techtarget.com/tip/Comparing-enterprise-data-anonymization-techniques
- 43. Thank You! Join the Conversation #WolframDataSummit @ParrottSquawk @ProjectOpenSOC Chester Parrott, Data Scientist, Cisco ATA PhD Student, LSU
Editor's Notes
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
- 25
- 26
- 27
- 28
- 29
- 30
- 31
- 32
- 33
- 34
- 35
- 36
- 37
- 38
- 39
- 40
- 41
- 42
- 43