CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover"

•

3 likes•2,897 views

The document discusses using data mining and machine learning techniques to gain intelligence from large datasets. It describes OpenDNS's security graph framework which uses force-directed graph algorithms to visualize relationships within network activity data in 3D. Examples are given around tracking the spread of Cryptolocker infections and analyzing co-occurrences within the data. Future work areas discussed include visualizing data evolution over time, improving scaling capabilities, and integrating threat detection and modern human-computer interaction techniques.

Technology

INTELLIGENT USE OF
INTELLIGENCE
DESIGNTO DISCOVER
CanSecWest 2014
PingYan : @pingpingya
&
Thibault Reuille : @ThibaultReuille
1
Monday, March 17, 14

PING
@pingpingya
Data Mining, Machine Learning
InfoSec
2
Monday, March 17, 14

THIBAULT
Parisian, moved to Cali in 2010
Security andVisualization ?
Demoscene rocks !
3
Monday, March 17, 14

AGENDA
01100100011000010111010001100001
Use cases - Cryptolocker
Conclusion
5
Big Data
Intelligence
Monday, March 17, 14

6
Continuous monitoring of everything? Yeah, sure
…
data != intelligence
THE HAYSTACK PROBLEM
Monday, March 17, 14

10
EXPLORATION PROCESS
Monday, March 17, 14

10
seed
EXPLORATION PROCESS
Monday, March 17, 14

10
seed Raw
Reﬁned
EXPLORATION PROCESS
Monday, March 17, 14

10
seed Raw
Reﬁned
Intelligence
EXPLORATION PROCESS
Monday, March 17, 14

11
TIME SPACE
TRANSACTIONS/
NETWORK Hunches
spiked in the past hour? clustered by geo?
Alice talked to Bob?
4-D APPROACHTO DATA
Monday, March 17, 14

12
22+
OPENDNS’S HAYSTACK
Monday, March 17, 14

15
Security Graph 3D
Monday, March 17, 14

FRAMEWORK
16
Data Extraction
Monday, March 17, 14

FRAMEWORK
17
Visualization Engine
Monday, March 17, 14

PARTICLE PHYSICS
18
Force Directed Layout
Monday, March 17, 14

WHY ?
Shape
Algorithms populate our knowledge graph
Creation is understood, output is complex
Layout deﬁned by model structure
Closer to the “natural shape” of data
Take advantage of the GPU to untangle information
Evolution
Security Graph is dynamic, constantly changing
Monitoring evolution over time
Investigation
Humans are better at processing shapes than numbers
Solid tool to build hypothesis / heuristics
20
Monday, March 17, 14

NATURAL CLUSTERING
21
Malicious domains hosting Nuclear exploit kits (pink) to
Hosting IPs (Yellow) graph
Monday, March 17, 14

1. Infection
2. Retrieve encryption key from CnC
3. Encrypt data ﬁles
4. Collect money
IP CnC fails quickly
DGA!
22
USE CASE #2 : CRYPTOLOCKER
Monday, March 17, 14

Ripple Effect on Co-occurrences
27
Monday, March 17, 14

USE CASE #3
28
Random Walk Live Demo
Monday, March 17, 14

FUTURE WORK
Over-Time
Visualizing data evolution over time (Currently in development)
Scaling
Port Force-Directed algorithm to OpenCL
Detection
Threat pattern detection (Find sub-graph inside Security Graph)
Example: DGA “nests”
Modern Human-Computer interaction
Leap Motion, Oculus, 3D glasses ...
29
Monday, March 17, 14

Ping
ping@opendns.com
@pingpingya
Thibault
thibault@opendns.com
@ThibaultReuille
thibaultreuille.tumblr.com
Blog
http://labs.umbrella.com
30
Monday, March 17, 14

The concept of intelligence can be observed and described in many different ways. Intelligence is primarily about processes that are cognitive, higher order involved mental processes, and memory. However, many theories still exist that try to explain intelligence. These theories are: multiple intelligences, emotional intelligence, and practical intelligences. As well as, how cultural impact plays a role within these theories.

Nature and Characteristics of Intelligence and Testing

MrsERivera

Psychology 102: Intelligence & intelligence assessment

James Neill

Data Science Popup Austin: Meet the PyData Community

Domino Data Lab

Introducción práctica al análisis de datos hasta la inteligencia artificial

fcoalberto

Mobile devices are becoming an increasingly integral part of criminal, legal, and regulatory investigations and disclosures. However, computers and mobile devices are often examined separately by different people, often due to technical and procedural reasons. That can make it almost impossible to identify and review evidence and intelligence across multiple data sources, devices, and crime scenes. Only when we look at all of the devices at the same time will we start to see the complete picture. In this webinar, we will look at some of the trends and challenges in acquiring and analysis mobile devices and will discuss: - What we can expect to recover from mobile devices today - What this data looks like when reviewed using Nuix - Techniques and workflows for optimising investigations that include mobile devices, computers, and cloud-based evidence.

Gamification of Geoinformation in Swiss Education and Research

Christian Sailer

The ubiquitous availability of mobile devices at the youth generation affords new concepts of education especially in the field of Geoinformation. Switzerlands' educators and researchers are very active providing new applications for K12 and higher Education. Gamification of such apps is increasing and impacts the GI Education in a positive way. This presentation was shared at Esri Education Userconference 2015 in San Diego.

A living hell - lessons learned in eight years of parsing real estate data

lokku

SC7 Workshop 3: The BDE pilot for secure societies

BigData_Europe

EGI impact on science and megatrends

EOSC-hub project

AI and the Future of Innovation - Daniel Hulme, Satalia

DigiMarCon - Digital Marketing, Media and Advertising Conferences & Exhibitions

Working in academia, the public and private sectors, Daniel is a leading expert in artificial intelligence as well as its applications and the social, commercial, economic and ethical implications. In a world where many believe access to more and more data will lead to ever better decision-making, he looks at what AI really is, as well as identifying the future challenges and opportunities for AI. He also asks how organisations need to change their structure and how these ideas could scale to a planet. Daniel will argue why we need to embrace these emerging technologies and will discuss the philosophical and ethical issues surrounding them.

Big Data: Personalisation, Prevention, Prediction - SOCAP 2014

John McKeever

Multi state churn analysis with a subscription product

Vienna Data Science Group

The consumer product landscape, particularly among e-commerce firms, includes a bevy of subscription-based business models. Internet and mobile phone subscriptions are now commonplace and joining the ranks are dietary supplements, meals, clothing, cosmetics and personal grooming products. Standard metrics to diagnose a healthy consumer-brand relationship typically include customer purchase frequency and ultimately, retention of the customer demonstrated by regular purchases. If a brand notices that a customer isn’t purchasing, it may consider targeting the customer with discount offers or deploying a tailored messaging campaign in the hope that the customer will return and not “churn”.The churn diagnosis, however, becomes more complicated for subscription-based products, many of which offer multiple delivery frequencies and the ability to pause a subscription. Brands with subscription-based products need to have some reliable measure of churn propensity so they can further isolate the factors that lead to churn and preemptively identify at-risk customers.

Infochimps Cloudcon 2012

Jim Kaskade

Decoding Data Science

Matt Fornito

CV | Michele Spagnuolo

Michele Spagnuolo

Adventures in Data Visualization. Greta Castellana, Giovanni Profeta, SUPSI

Data Driven Innovation

New DNS Traffic Analysis Techniques to Identify Global Internet Threats

OpenDNS

Leveraging DNS data to detect new Internet threats has been gaining in popularity in the past few years. However, most industry and academic work examines DNS solely from the authoritative layer through the use of passive DNS. This presentation covers three novel methods that can be used to detect network threats at an Internet scale by analyzing DNS traffic below and above the recursive layer, monitoring malware hosting IP infrastructures, and applying graph analytics on DNS lookup patterns.

Blackhat USA 2015: BGP Stream Presentation

OpenDNS

What Happens Before the Kill Chain

OpenDNS

Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...OpenDNS

Highly Available Docker Networking With BGP

OpenDNS

One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen

OpenDNS

Security Ninjas: An Open Source Application Security Training Program

OpenDNS

NOTES -- Slide 8 Some of the categories we will discuss are very broad like this one. Untrusted command – get / post / rest style params Clicks Surprise inputs Slide 13 Very broad too Little or no auth Auth with some bypass possibilities Some problem with how session is generated, managed, expired Insufficient sessionID protection Slide 18 When a user is tricked into clicking on a malicious link, submitting a specially crafted form, or even just browsing to a malicious site, the injected code travels to the vulnerable web site, which reflects the attack back to the user’s browser. Slide 27 Security hardening throughout Application Stack Unnecessary features enabled or installed? ports, services, pages, accounts, privileges Security settings in your development frameworks (e.g., Struts, Spring, ASP.NET) and libraries not set to secure values? Default accounts/ passwords still enabled and unchanged? Error handling reveal stack traces or other overly informative error messages to users? Software out of date? OS, Web Server, DBMS, applications, code libraries Slide 41 sign up for updates or do regular audits to see versions there might be technical dependencies easily exploited by attackers using metaspoilt, info gathering using headers & responses, etc. Slide 47 We can look at the architecture, give you tips around what you could use, what would be good. This would avoid making any major changes when the product is ready which would save everyone’s time in the long run. Have sprints with dedicated security features and use those as a selling point for our security conscious customers Slide 48 Carefully look at the license to make sure you can use it in your type of product. Ask Fallon if you are not sure Research how much support it gets, how popular it is Look to find out any vulnerabilities in it before you start using it Maintain it; Sign up for CVE updates Ask us if you need to get something reviewed Slide 50 Not only better and more features Security vulnerabilities get patched in new versions New versions get most attention by the companies and old ones stop getting support after some time fully Most Security Support by the community Turn on auto updates for Chrome; always look at updates on AppStore Slide 51 Use different passwords for different sites Password managers let you set complexity, generate random passwords, etc. Slide 52 Only grant access to whats needed to get the job done employee leaves; mistakes; vulnerabilities in other s/w which leverages this; Don’t install redundant software, plugins, etc. This opens up so much risk People forget to uninstall them; s/w doesn't get much attention from community; open ports are left; boom exploited by attackers; Slide 55 To prevent unintended execution actions e.g., fail open auth errors Leak minimal info about infrastructure as this info is leveraged by attackers to carry out further attacks

Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...

OpenDNS

OpenDNS CTO Dan Hubbard VizSec 2014 Keynote Slides

OpenDNS

Docker at OpenDNS

OpenDNS

IP Routing, AWS, and Docker

OpenDNS

Rahim Lalani is a Systems Engineer at OpenDNS. He gave a talk at the Docker Vancouver meetup on May 8th, 2014 covering some experiments that he did along with Andree Toonk, OpenDNS's Network Engineering Manager, to route OpenDNS IP address space into containers running on AWS EC2 instances. Addtional details can be found in his blog post: http://engineering.opendns.com/2014/07/01/ip-routing-aws-docker/

Defcon

OpenDNS

Marauder or Scanning Your DNSDB for Fun and Profit - SOURCE Boston

OpenDNS

Network Security: A Four Point Analysis of Appliances vs. the Cloud

OpenDNS

When you're assessing network security solutions, you face two fundamental choices with dramatic consequences for protection, coverage, performance and manageability. Appliance-based solutions seek to arm organizations with visibility and control within their network environment. Cloud-based solutions promise easier setup, greater scalability, wider coverage and adaptive protection. How do you weigh the promised benefits against the potential risks? Does one option offer distinct advantages over the other?

Rethinking Cyber-Security: 7 Key Strategies for the Challenges that Lie Ahead

OpenDNS

Practice makes perfect. And unfortunately for security professionals, attackers have realized that persistence is a powerful approach to breaching an organization's defenses. Focusing on prevention alone is no longer a sufficient strategy for securing your organization against the business risks of a breach. Our current security environment demands an approach less centered on ideal prevention and more focused on reality. During this webcast, we discussed key strategies that limit your risk and exposure to unrelenting threats. Some highlighted topics include: - How the shift in attacker motivations has impacted today's threat landscape - Why preventative techniques alone can no longer ensure a secure environment - Which strategies need to be considered for a holistic approach to security - What next steps you can take towards identifying your best strategy against attacks

Speak Security: Under the Hood of the OpenDNS Security Research Labs with Dhi...

OpenDNS

Malware reversing is a conventional threat intelligence strategy that is being challenged to keep up with the fast-paced evolution of threats. To stay ahead of bad actors, the next generation security intelligence engine is big data, not malware reversing. An advanced generation of security intelligence teams has risen with mathematicians, algorithmic geniuses and big data researchers. The buzz words sound impressive but what does this actually mean in practice? On Jan 22nd, OpenDNS Security Researcher, Dhia Mahjoub, and Senior Product Manager, Dima Kumets, went under the hood of OpenDNS Security Research Labs. Their discussion included such topics as: -What the OpenDNS Researchers actually do and why it's so different from traditional sample analysis -The process of developing and improving learning machines as developed by Dhia and the Labs Team -Insights gained from looking at Internet traffic as a whole -The difference in Big Data insight vs Malware Reversing -The latest threats OpenDNS Security Labs is mitigating

Baythreat Cryptolocker Presentation

OpenDNS

Cryptolocker Webcast

OpenDNS

Each day millions of Internet requests are made to dynamically changing Cryptolocker domains. And it only takes one successful connection from a malware-infected system to the botnet controller for your files to end up encrypted and held for ransom. So how does Cryptolocker actually work? What is the best way to block it? And what implications does this have for security methods going forward? In this webcast, you will learn: -What steps are involved in a Cryptolocker attack -How Domain Generation Algorithms enable it to evade most threat detection methods -Why leveraging our global intelligence has been effective in containing Cryptolocker -What you can do to avoid becoming a victim

MSP Webcast - Leveraging Cloud Security to Become a Virtual CIO

OpenDNS

Ransomware, trojans, and keyloggers are increasingly targeting SMBs—and traditional, reactive security solutions are not cutting it. Malware not only puts your customers at risk but also hurts your bottom line through hours wasted cleaning up infected machines. But how do you protect customers that may not understand the risks or the value of layered security? The answer lies in leveraging increased visibility and value reporting to improve your bottom line and become your customer's virtual CIO and CISO. Join OpenDNS Sr. Product Manager Dima Kumets and guest speaker Jim Lancaster of MSPmentor 100 company Sagiss to learn about: -Combining protection and containment to lower costs -Improving renewal rates through value reporting -Leveraging OpenDNS's new integration with ConnectWise to be the Virtual CIO -Monitoring real-time network activity as a sellable service

More from OpenDNS (20)

New DNS Traffic Analysis Techniques to Identify Global Internet Threats

Blackhat USA 2015: BGP Stream Presentation

What Happens Before the Kill Chain

Using Algorithms to Brute Force Algorithms...A Journey Through Time and Names...

Highly Available Docker Networking With BGP

One Phish, Two Phish, Red Phish, Your Account Details Just Got Stolen

Security Ninjas: An Open Source Application Security Training Program

Infrastructure Tracking with Passive Monitoring and Active Probing: ShmooCon ...

OpenDNS CTO Dan Hubbard VizSec 2014 Keynote Slides

Standardizing and Strengthening Security to Lower Costs

Docker at OpenDNS

IP Routing, AWS, and Docker

Defcon

Marauder or Scanning Your DNSDB for Fun and Profit - SOURCE Boston

Network Security: A Four Point Analysis of Appliances vs. the Cloud

Rethinking Cyber-Security: 7 Key Strategies for the Challenges that Lie Ahead

Speak Security: Under the Hood of the OpenDNS Security Research Labs with Dhi...

Baythreat Cryptolocker Presentation

Cryptolocker Webcast

MSP Webcast - Leveraging Cloud Security to Become a Virtual CIO

Recently uploaded

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

James Anderson

Effective Application Security in Software Delivery lifecycle using Deployment Firewall and DBOM The modern software delivery process (or the CI/CD process) includes many tools, distributed teams, open-source code, and cloud platforms. Constant focus on speed to release software to market, along with the traditional slow and manual security checks has caused gaps in continuous security as an important piece in the software supply chain. Today organizations feel more susceptible to external and internal cyber threats due to the vast attack surface in their applications supply chain and the lack of end-to-end governance and risk management. The software team must secure its software delivery process to avoid vulnerability and security breaches. This needs to be achieved with existing tool chains and without extensive rework of the delivery processes. This talk will present strategies and techniques for providing visibility into the true risk of the existing vulnerabilities, preventing the introduction of security issues in the software, resolving vulnerabilities in production environments quickly, and capturing the deployment bill of materials (DBOM). Speakers: Bob Boule Robert Boule is a technology enthusiast with PASSION for technology and making things work along with a knack for helping others understand how things work. He comes with around 20 years of solution engineering experience in application security, software continuous delivery, and SaaS platforms. He is known for his dynamic presentations in CI/CD and application security integrated in software delivery lifecycle. Gopinath Rebala Gopinath Rebala is the CTO of OpsMx, where he has overall responsibility for the machine learning and data processing architectures for Secure Software Delivery. Gopi also has a strong connection with our customers, leading design and architecture for strategic implementations. Gopi is a frequent speaker and well-known leader in continuous delivery and integrating security into software delivery.

Elizabeth Buie - Older adults: Are we really designing for our future selves?

Nexer Digital

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf

91mobiles

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

Albert Hoitingh

GraphRAG is All You need? LLM & Knowledge Graph

Guy Korland

Guy Korland, CEO and Co-founder of FalkorDB, will review two articles on the integration of language models with knowledge graphs. 1. Unifying Large Language Models and Knowledge Graphs: A Roadmap. https://arxiv.org/abs/2306.08302 2. Microsoft Research's GraphRAG paper and a review paper on various uses of knowledge graphs: https://www.microsoft.com/en-us/research/blog/graphrag-unlocking-llm-discovery-on-narrative-private-data/

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

nkrafacyberclub

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

DanBrown980551

Do you want to learn how to model and simulate an electrical network from scratch in under an hour? Then welcome to this PowSyBl workshop, hosted by Rte, the French Transmission System Operator (TSO)! During the webinar, you will discover the PowSyBl ecosystem as well as handle and study an electrical network through an interactive Python notebook. PowSyBl is an open source project hosted by LF Energy, which offers a comprehensive set of features for electrical grid modelling and simulation. Among other advanced features, PowSyBl provides: - A fully editable and extendable library for grid component modelling; - Visualization tools to display your network; - Grid simulation tools, such as power flows, security analyses (with or without remedial actions) and sensitivity analyses; The framework is mostly written in Java, with a Python binding so that Python developers can access PowSyBl functionalities as well. What you will learn during the webinar: - For beginners: discover PowSyBl's functionalities through a quick general presentation and the notebook, without needing any expert coding skills; - For advanced developers: master the skills to efficiently apply PowSyBl functionalities to your real-world scenarios.

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

FIDO Alliance

DevOps and Testing slides at DASA Connect

Kari Kakkonen

By Design, not by Accident - Agile Venture Bolzano 2024

Pierluigi Pugliese

Quantum Computing: Current Landscape and the Future Role of APIs

Vlad Stirbu

Accelerate your Kubernetes clusters with Varnish Caching

Thijs Feryn

Securing your Kubernetes cluster_ a step-by-step guide to success !

KatiaHIMEUR1

Today, after several years of existence, an extremely active community and an ultra-dynamic ecosystem, Kubernetes has established itself as the de facto standard in container orchestration. Thanks to a wide range of managed services, it has never been so easy to set up a ready-to-use Kubernetes cluster. However, this ease of use means that the subject of security in Kubernetes is often left for later, or even neglected. This exposes companies to significant risks. In this talk, I'll show you step-by-step how to secure your Kubernetes cluster for greater peace of mind and reliability.

Elevating Tactical DDD Patterns Through Object Calisthenics

Dorra BARTAGUIZ

After immersing yourself in the blue book and its red counterpart, attending DDD-focused conferences, and applying tactical patterns, you're left with a crucial question: How do I ensure my design is effective? Tactical patterns within Domain-Driven Design (DDD) serve as guiding principles for creating clear and manageable domain models. However, achieving success with these patterns requires additional guidance. Interestingly, we've observed that a set of constraints initially designed for training purposes remarkably aligns with effective pattern implementation, offering a more ‘mechanical’ approach. Let's explore together how Object Calisthenics can elevate the design of your tactical DDD patterns, offering concrete help for those venturing into DDD for the first time!

Pushing the limits of ePRTC: 100ns holdover for 100 days

Adtran

Video Streaming: Then, Now, and in the Future

Alpen-Adria-Universität

In his public lecture, Christian Timmerer provides insights into the fascinating history of video streaming, starting from its humble beginnings before YouTube to the groundbreaking technologies that now dominate platforms like Netflix and ORF ON. Timmerer also presents provocative contributions of his own that have significantly influenced the industry. He concludes by looking at future challenges and invites the audience to join in a discussion.

The Metaverse and AI: how can decision-makers harness the Metaverse for their...

Jen Stirrup

The Metaverse is popularized in science fiction, and now it is becoming closer to being a part of our daily lives through the use of social media and shopping companies. How can businesses survive in a world where Artificial Intelligence is becoming the present as well as the future of technology, and how does the Metaverse fit into business strategy when futurist ideas are developing into reality at accelerated rates? How do we do this when our data isn't up to scratch? How can we move towards success with our data so we are set up for the Metaverse when it arrives? How can you help your company evolve, adapt, and succeed using Artificial Intelligence and the Metaverse to stay ahead of the competition? What are the potential issues, complications, and benefits that these technologies could bring to us and our organizations? In this session, Jen Stirrup will explain how to start thinking about these technologies as an organisation.

RESUME BUILDER APPLICATION Project for students

KAMESHS29

Introduction to CHERI technology - Cybersecurity

mikeeftimakis1

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

James Anderson

Recently uploaded (20)

Alt. GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using ...

Elizabeth Buie - Older adults: Are we really designing for our future selves?

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf

Encryption in Microsoft 365 - ExpertsLive Netherlands 2024

GraphRAG is All You need? LLM & Knowledge Graph

Secstrike : Reverse Engineering & Pwnable tools for CTF.pptx

LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...

FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf

DevOps and Testing slides at DASA Connect

By Design, not by Accident - Agile Venture Bolzano 2024

Quantum Computing: Current Landscape and the Future Role of APIs

Accelerate your Kubernetes clusters with Varnish Caching

Securing your Kubernetes cluster_ a step-by-step guide to success !

Elevating Tactical DDD Patterns Through Object Calisthenics

Pushing the limits of ePRTC: 100ns holdover for 100 days

Video Streaming: Then, Now, and in the Future

The Metaverse and AI: how can decision-makers harness the Metaverse for their...

RESUME BUILDER APPLICATION Project for students

Introduction to CHERI technology - Cybersecurity

GDG Cloud Southlake #33: Boule & Rebala: Effective AppSec in SDLC using Deplo...

CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover"

1. INTELLIGENT USE OF INTELLIGENCE DESIGNTO DISCOVER CanSecWest 2014 PingYan : @pingpingya & Thibault Reuille : @ThibaultReuille 1 Monday, March 17, 14

2. PING @pingpingya Data Mining, Machine Learning InfoSec 2 Monday, March 17, 14

3. THIBAULT Parisian, moved to Cali in 2010 Security andVisualization ? Demoscene rocks ! 3 Monday, March 17, 14

4. 4 Monday, March 17, 14

5. AGENDA 01100100011000010111010001100001 Use cases - Cryptolocker Conclusion 5 Big Data Intelligence Monday, March 17, 14

6. 6 Continuous monitoring of everything? Yeah, sure … data != intelligence THE HAYSTACK PROBLEM Monday, March 17, 14

7. 7 Monday, March 17, 14

8. 8 Monday, March 17, 14

9. 8 Monday, March 17, 14

10. 9 Monday, March 17, 14

11. 10 EXPLORATION PROCESS Monday, March 17, 14

12. 10 seed EXPLORATION PROCESS Monday, March 17, 14

13. 10 seed EXPLORATION PROCESS Monday, March 17, 14

14. 10 seed EXPLORATION PROCESS Monday, March 17, 14

15. 10 seed EXPLORATION PROCESS Monday, March 17, 14

16. 10 seed Raw Reﬁned EXPLORATION PROCESS Monday, March 17, 14

17. 10 seed Raw Reﬁned Intelligence EXPLORATION PROCESS Monday, March 17, 14

18. 11 TIME SPACE TRANSACTIONS/ NETWORK Hunches spiked in the past hour? clustered by geo? Alice talked to Bob? 4-D APPROACHTO DATA Monday, March 17, 14

19. 12 22+ OPENDNS’S HAYSTACK Monday, March 17, 14

20. 13 Monday, March 17, 14

21. 14 3D view ! Monday, March 17, 14

22. 15 Security Graph 3D Monday, March 17, 14

23. FRAMEWORK 16 Data Extraction Monday, March 17, 14

24. FRAMEWORK 17 Visualization Engine Monday, March 17, 14

25. PARTICLE PHYSICS 18 Force Directed Layout Monday, March 17, 14

26. PARTICLES 19 Monday, March 17, 14

27. WHY ? Shape Algorithms populate our knowledge graph Creation is understood, output is complex Layout deﬁned by model structure Closer to the “natural shape” of data Take advantage of the GPU to untangle information Evolution Security Graph is dynamic, constantly changing Monitoring evolution over time Investigation Humans are better at processing shapes than numbers Solid tool to build hypothesis / heuristics 20 Monday, March 17, 14

28. NATURAL CLUSTERING 21 Malicious domains hosting Nuclear exploit kits (pink) to Hosting IPs (Yellow) graph Monday, March 17, 14

29. 1. Infection 2. Retrieve encryption key from CnC 3. Encrypt data ﬁles 4. Collect money IP CnC fails quickly DGA! 22 USE CASE #2 : CRYPTOLOCKER Monday, March 17, 14

30. 23 Monday, March 17, 14

31. 24 CO-OCCURRENCES Monday, March 17, 14

32. CO-OCCURRENCES 25 Monday, March 17, 14

33. ALGORITHM 26 Monday, March 17, 14

34. Ripple Effect on Co-occurrences 27 Monday, March 17, 14

35. USE CASE #3 28 Random Walk Live Demo Monday, March 17, 14

36. FUTURE WORK Over-Time Visualizing data evolution over time (Currently in development) Scaling Port Force-Directed algorithm to OpenCL Detection Threat pattern detection (Find sub-graph inside Security Graph) Example: DGA “nests” Modern Human-Computer interaction Leap Motion, Oculus, 3D glasses ... 29 Monday, March 17, 14

37. Ping ping@opendns.com @pingpingya Thibault thibault@opendns.com @ThibaultReuille thibaultreuille.tumblr.com Blog http://labs.umbrella.com 30 Monday, March 17, 14

CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover"

Recommended

Recommended

More Related Content

Similar to CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover"

Similar to CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover" (13)

More from OpenDNS

More from OpenDNS (20)

Recently uploaded

Recently uploaded (20)

CanSecWest 2014 Presentation: "Intelligent Use of Intelligence: Design to Discover"