Complementing static and dynamic analysis approaches for better
•Download as PPTX, PDF•
1 like•83 views
This document proposes combining static and dynamic analysis approaches for better network defense. Static analysis provides low false negative rates but takes longer to mature, while dynamic analysis has a faster time to detection but higher false negatives. The complementary approach reconstructs files at the gateway, performs static analysis, and only invokes dynamic analysis when files are deemed suspicious to gain the benefits of both methods. It involves host agents, a dynamic analyzer, static analyzer, and gateway controller working together to tag files based on both analyses.
Report
Share
Report
Share
Recommended
Spring colloquium
Route leaks occur when improper network prefixes are advertised and propagated throughout the network leading to packet loss. Having an automated approach to detect and correct route leaks is beneficial. In this research, an Enterprise environment was emulated with Autonomous Systems (AS) running Border Gateway Protocol (BGP) and a server storing telemetry route data. A network design that detects route leak efficiently and blocks the leaked traffic with the Engineer’s approval was implemented by using prefix lists on edge devices. The proposed detection mechanism considers factors like BGP origin AS, timestamp, and network prefix. The Routing Information Base (RIB) data is stored and analyzed in a database from which the developed algorithm fetches the data for route leak detection, and the alerting system notifies the hijacked AS when a route leak is detected. The results of the algorithm developed enables real-time route leak detection, alerts the respective enterprise, and blocks the network within the local enterprise upon user’s approval.
Billions & Billions of Logs
This talk was intended for the 2017 Sans ThreatHunting Summit and 2017 x33fcon. Unfortunately I was unable to attend either.
Applied Detection and Analysis Using Flow Data - MIRCon 2014
In this presentation, Chris Sanders and Jason Smith discuss the importance of using flow data for network security analysis. Flow data is discussed from the viewpoints of collection, detection, and analysis. We also discuss the FlowPlotter tool, and the use of FlowBAT, a graphical flow analysis GUI we've created.
Filar seymour oreilly_bot_story_
This document discusses the design of an intelligent assistant named Artemis to help security analysts with their workflow. It describes conducting user research to understand pain points of different security roles. The findings showed analysts lack context for alerts and have repetitive tasks. The document outlines requirements for Artemis, including understanding natural language, providing context-driven investigations, educating users, recommending next steps, and expediting collections using workflows. It provides examples of how Artemis could assist analysts and help optimize their time by automating common tasks. In the end, the goal is to design tools that better utilize analyst resources and are easier for a diverse range of users.
Penentration testing
Main objective,Purpose, Penetration Testing Strategies, Process and Methodology , Usage , Limitations , Significance
Timing attacks have never been so practical: Advance cross site search attacks
Cross-site search (XS-search) is a practical timing side-channel attack that allows the extraction of sensitive information from web-services. The attack exploits inflation techniques to efficiently distinguish between search requests that yield results and requests that do not. This work focuses on the response inflation technique that increases the size of the response; as the difference in the sizes of the responses increases, it becomes easier to distinguish between them. We begin with browser-based XS-search attack and demonstrate its use in extracting users' private data from Gmail and Facebook. The browser-based XS-search attack exploits the differences in the sizes of HTTP responses, and works even when significant inflation of the response is impossible. This part also involves algorithmic improvements compared to previous work. When there is no leakage of information via the timing side channel it is possible to use second-order (SO) XS-search, a novel type of attack that allows the attacker to significantly increase the difference in the sizes of the responses by planting maliciously crafted record into the storage. SO XS-search attacks can be used to extract sensitive information such as email content of Gmail and Yahoo! users, and search history of Bing users.
(Source: Black Hat USA 2016, Las Vegas)
Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE
Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE by Dragos Adversary Hunter Joe Slowik - as presented at Virus Bulletin Oct 2018
Cloud Computing basic
this is ppt for understanding the cloud and if any confusion regarding what;s cloud.
Initial slides to explain the cloud's SAAS (pictorial) etc are taken from Rosalyn blog.
Recommended
Spring colloquium
Route leaks occur when improper network prefixes are advertised and propagated throughout the network leading to packet loss. Having an automated approach to detect and correct route leaks is beneficial. In this research, an Enterprise environment was emulated with Autonomous Systems (AS) running Border Gateway Protocol (BGP) and a server storing telemetry route data. A network design that detects route leak efficiently and blocks the leaked traffic with the Engineer’s approval was implemented by using prefix lists on edge devices. The proposed detection mechanism considers factors like BGP origin AS, timestamp, and network prefix. The Routing Information Base (RIB) data is stored and analyzed in a database from which the developed algorithm fetches the data for route leak detection, and the alerting system notifies the hijacked AS when a route leak is detected. The results of the algorithm developed enables real-time route leak detection, alerts the respective enterprise, and blocks the network within the local enterprise upon user’s approval.
Billions & Billions of Logs
This talk was intended for the 2017 Sans ThreatHunting Summit and 2017 x33fcon. Unfortunately I was unable to attend either.
Applied Detection and Analysis Using Flow Data - MIRCon 2014
In this presentation, Chris Sanders and Jason Smith discuss the importance of using flow data for network security analysis. Flow data is discussed from the viewpoints of collection, detection, and analysis. We also discuss the FlowPlotter tool, and the use of FlowBAT, a graphical flow analysis GUI we've created.
Filar seymour oreilly_bot_story_
This document discusses the design of an intelligent assistant named Artemis to help security analysts with their workflow. It describes conducting user research to understand pain points of different security roles. The findings showed analysts lack context for alerts and have repetitive tasks. The document outlines requirements for Artemis, including understanding natural language, providing context-driven investigations, educating users, recommending next steps, and expediting collections using workflows. It provides examples of how Artemis could assist analysts and help optimize their time by automating common tasks. In the end, the goal is to design tools that better utilize analyst resources and are easier for a diverse range of users.
Penentration testing
Main objective,Purpose, Penetration Testing Strategies, Process and Methodology , Usage , Limitations , Significance
Timing attacks have never been so practical: Advance cross site search attacks
Cross-site search (XS-search) is a practical timing side-channel attack that allows the extraction of sensitive information from web-services. The attack exploits inflation techniques to efficiently distinguish between search requests that yield results and requests that do not. This work focuses on the response inflation technique that increases the size of the response; as the difference in the sizes of the responses increases, it becomes easier to distinguish between them. We begin with browser-based XS-search attack and demonstrate its use in extracting users' private data from Gmail and Facebook. The browser-based XS-search attack exploits the differences in the sizes of HTTP responses, and works even when significant inflation of the response is impossible. This part also involves algorithmic improvements compared to previous work. When there is no leakage of information via the timing side channel it is possible to use second-order (SO) XS-search, a novel type of attack that allows the attacker to significantly increase the difference in the sizes of the responses by planting maliciously crafted record into the storage. SO XS-search attacks can be used to extract sensitive information such as email content of Gmail and Yahoo! users, and search history of Bing users.
(Source: Black Hat USA 2016, Las Vegas)
Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE
Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE by Dragos Adversary Hunter Joe Slowik - as presented at Virus Bulletin Oct 2018
Cloud Computing basic
this is ppt for understanding the cloud and if any confusion regarding what;s cloud.
Initial slides to explain the cloud's SAAS (pictorial) etc are taken from Rosalyn blog.
CBGTBT - Part 5 - Blockchains 102
A Complete Beginners Guide to Blockchain Technology Part 5 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 6 - Transactions 102
A Complete Beginners Guide to Blockchain Technology Part 6 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
Bitcoin and Blockchain Technology Explained: Not just Cryptocurrencies, Econo...
The blockchain concept may be one of the most transformative ideas to impact the world since the Internet. It represents a new organizing paradigm for all activity and integrates humans and technology. Cryptocurrencies like bitcoin are merely one application of the blockchain concept. The blockchain is a public transaction ledger built in a network structure based on cryptographic principles so there does not need to be a centralized intermediary. Any kind of asset (art, car, home, financial contract) may be encoded into the blockchain and transacted, validated, or preserved in a much more efficient manner than at present including ideas, health data, financial assets, automobiles, and government documents. Blockchain technology applies well beyond cryptocurrencies, economics, and markets to all venues of human information processing, collaboration, and interaction including art, health, and literacy.
CBGTBT - Part 4 - Mining
A Complete Beginners Guide to Blockchain Technology Part 4 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 2 - Blockchains 101
A Complete Beginners Guide to Blockchain Technology Part 2 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 3 - Transactions 101
A Complete Beginners Guide to Blockchain Technology Part 3 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 1 - Workshop introduction & primer
A Complete Beginners Guide to Blockchain Technology Part 1 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
How to Make Awesome SlideShares: Tips & Tricks
Turbocharge your online presence with SlideShare. We provide the best tips and tricks for succeeding on SlideShare. Get ideas for what to upload, tips for designing your deck and more.
Getting Started With SlideShare
SlideShare is a global platform for sharing presentations, infographics, videos and documents. It has over 18 million pieces of professional content uploaded by experts like Eric Schmidt and Guy Kawasaki. The document provides tips for setting up an account on SlideShare, uploading content, optimizing it for searchability, and sharing it on social media to build an audience and reputation as a subject matter expert.
Security Automation Quick Wins - Siemplify Webinar
This document discusses security automation and provides examples of processes that can be automated. It notes that 96% of respondents have security orchestration projects underway to automate manual tasks. The top areas ripe for automation include data collection/enrichment, triage of low fidelity alerts, and establishing consistent processes. The document then provides examples of automation workflows that can be used for common security issues like phishing, malware, DLP, and account misuse. These examples outline steps that can be automated, like data gathering, analysis, response, and feedback.
Security Analytics for Data Discovery - Closing the SIEM Gap
This document discusses security analytics and hunting maturity. It defines hunting as a proactive approach to identifying incidents by actively looking for patterns, intelligence or hunches, rather than waiting for notifications. It describes the "SIEM gap" where SIEM tools are designed for known threats and lack the tools and flexibility for human analysis and hunting of unknown threats. It outlines techniques used in security analytics like event clustering, association analysis, and visualization to help analyze large datasets and discover unknown threats. The document argues security analytics provides the data access, analysis techniques and workflows to help close the SIEM gap and improve an organization's hunting maturity over time.
Sasa milic, cisco advanced malware protection
Cisco Advanced Malware Protection uses a combination of techniques including signatures, machine learning, dynamic analysis, and behavioral analytics to both prevent known threats and detect previously unknown threats retrospectively. It provides security for networks, endpoints, and mobile devices through a cloud-based platform that shares threat intelligence between Cisco and its customers.
Computer Forensics
This document discusses computer forensics and outlines best practices for evidence collection, analysis, and reporting. It defines key terms like evidence, chain of custody, and imaging. It emphasizes the importance of planning, minimizing data loss, documenting all actions, and analyzing all collected data to ensure the integrity of the forensic investigation process.
Blackhat 2018 - The New Pentest? Rise of the Compromise Assessment
The document discusses compromise assessments, which are proactive evaluations of systems to detect threats that have evaded existing security controls. A compromise assessment is faster, more affordable, and independent compared to traditional vulnerability assessments and penetration tests. The assessment methodology involves planning, preparation, discovery, collection of data from endpoints, analysis of the collected data using techniques like forensic state analysis, and reporting of findings. It is recommended that organizations conduct regular compromise assessments by a third party to validate network security and detect any unauthorized access.
The New Pentest? Rise of the Compromise Assessment
If an attacker had a foothold in your network today, would you know it?
If they made it past your real-time defense measures (EDR, EPP, AV, UEBA, firewalls, etc.) or an analyst misinterpreted a critical alert, chances are they've entrenched themselves for the long haul. Skilled and organized attackers know long-term persistence in your network is the most critical component to meeting their goal of stealing information, causing damage, or pivoting attacks on other organizations.
Threat hunting is the proactive practice of finding attackers in your environment before they can cause damage (or at least stop the bleeding from continued exposure). Unfortunately, effective threat hunting practices remain out-of-reach for most organizations due to lack of security infrastructure and qualified people to manage advanced endpoint security solutions.
One solution to this problem is to hire a third party to conduct a periodic assessment geared toward discovery of unauthorized access and compromised systems. This is called a "compromise assessment" and just recently compromise assessments have become one of the most requested services from top security service providers.
Customers don’t want to just know if they can be hacked (a good penetration tester will generally conclude “yes”) they want to know if they ARE hacked—right now—and if so, what endpoints/hosts/servers on their network are compromised.
In this presentation, which was originally prepared for Black Hat 2018, Chris Gerritz outlines the growing practice of compromise assessments and the best practices being utilized by some of the largest and most sophisticated managed security service providers (MSSPs) with this offering.
What approaches are most effective?
What data is being utilized?
What are some of the top challenges?
To request a free 100-node compromise assessment or to learn more about Infocyte HUNT — our comprehensive threat hunting platform — and start a free trial, please visit https://try.infocyte.com.
Automatic test packet generation
This document discusses Automatic Test Packet Generation (ATPG), which automatically generates test packets to check the health and functionality of a network. It aims to detect common network failures like hardware failures, software bugs, reachability issues, and performance degradation. The ATPG system works by performing reachability analysis to determine all possible packet flows, generating a minimum set of test packets to exercise the entire rule set, and using the results to localize any faults by eliminating passing rules and identifying broken ones. Implementing ATPG could provide more efficient network testing than current tools like ping and traceroute, helping reduce downtime and costs associated with network outages.
detection and classification of malware.pptx
The document presents a technique for detecting and classifying self-deleting malware using Windows Prefetch files. It trains a KNN classifier to detect malware execution based on prefetch file features. It then applies a Jaccard similarity classifier to attribute the malware to a family. The approach extracts features from over 4,000 malware and benign prefetch files, applies normalization to select relevant features, trains the KNN detector, and uses minimum family features and Jaccard similarity to classify into 48 malware families. The technique can detect malware execution and attribute it to a family using only prefetch file evidence, without accessing the original malware sample.
Empowering Growth with Best Software Development Company in Noida - Deuglo
Do you want Software for your Business? Visit Deuglo
Deuglo has top Software Developers in India. They are experts in software development and help design and create custom Software solutions.
Deuglo follows seven steps methods for delivering their services to their customers. They called it the Software development life cycle process (SDLC).
Requirement — Collecting the Requirements is the first Phase in the SSLC process.
Feasibility Study — after completing the requirement process they move to the design phase.
Design — in this phase, they start designing the software.
Coding — when designing is completed, the developers start coding for the software.
Testing — in this phase when the coding of the software is done the testing team will start testing.
Installation — after completion of testing, the application opens to the live server and launches!
Maintenance — after completing the software development, customers start using the software.
Vitthal Shirke Java Microservices Resume.pdf
Software Engineering, Software Consulting, Tech Lead, Spring Boot, Spring Cloud, Spring Core, Spring JDBC, Spring Transaction, Spring MVC, OpenShift Cloud Platform, Kafka, REST, SOAP, LLD & HLD.
Transform Your Communication with Cloud-Based IVR Solutions
Discover the power of Cloud-Based IVR Solutions to streamline communication processes. Embrace scalability and cost-efficiency while enhancing customer experiences with features like automated call routing and voice recognition. Accessible from anywhere, these solutions integrate seamlessly with existing systems, providing real-time analytics for continuous improvement. Revolutionize your communication strategy today with Cloud-Based IVR Solutions. Learn more at: https://thesmspoint.com/channel/cloud-telephony
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
Zoom is a comprehensive platform designed to connect individuals and teams efficiently. With its user-friendly interface and powerful features, Zoom has become a go-to solution for virtual communication and collaboration. It offers a range of tools, including virtual meetings, team chat, VoIP phone systems, online whiteboards, and AI companions, to streamline workflows and enhance productivity.
May Marketo Masterclass, London MUG May 22 2024.pdf
Can't make Adobe Summit in Vegas? No sweat because the EMEA Marketo Engage Champions are coming to London to share their Summit sessions, insights and more!
This is a MUG with a twist you don't want to miss.
More Related Content
Viewers also liked
CBGTBT - Part 5 - Blockchains 102
A Complete Beginners Guide to Blockchain Technology Part 5 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 6 - Transactions 102
A Complete Beginners Guide to Blockchain Technology Part 6 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
Bitcoin and Blockchain Technology Explained: Not just Cryptocurrencies, Econo...
The blockchain concept may be one of the most transformative ideas to impact the world since the Internet. It represents a new organizing paradigm for all activity and integrates humans and technology. Cryptocurrencies like bitcoin are merely one application of the blockchain concept. The blockchain is a public transaction ledger built in a network structure based on cryptographic principles so there does not need to be a centralized intermediary. Any kind of asset (art, car, home, financial contract) may be encoded into the blockchain and transacted, validated, or preserved in a much more efficient manner than at present including ideas, health data, financial assets, automobiles, and government documents. Blockchain technology applies well beyond cryptocurrencies, economics, and markets to all venues of human information processing, collaboration, and interaction including art, health, and literacy.
CBGTBT - Part 4 - Mining
A Complete Beginners Guide to Blockchain Technology Part 4 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 2 - Blockchains 101
A Complete Beginners Guide to Blockchain Technology Part 2 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 3 - Transactions 101
A Complete Beginners Guide to Blockchain Technology Part 3 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
CBGTBT - Part 1 - Workshop introduction & primer
A Complete Beginners Guide to Blockchain Technology Part 1 of 6. Slides from the #StartingBlock2015 tour by @blockstrap
Part 1: http://www.slideshare.net/Blockstrap/cbgtbt-part-1-workshop-introduction-primer
Part 2: http://www.slideshare.net/Blockstrap/02-blockchains-101
Part 3: http://www.slideshare.net/Blockstrap/03-transactions-101
Part 4: http://www.slideshare.net/Blockstrap/cbgtbt-part-4-mining
Part 5: http://www.slideshare.net/Blockstrap/05-blockchains-102
Part 6: http://www.slideshare.net/Blockstrap/06-transactions-102
How to Make Awesome SlideShares: Tips & Tricks
Turbocharge your online presence with SlideShare. We provide the best tips and tricks for succeeding on SlideShare. Get ideas for what to upload, tips for designing your deck and more.
Getting Started With SlideShare
SlideShare is a global platform for sharing presentations, infographics, videos and documents. It has over 18 million pieces of professional content uploaded by experts like Eric Schmidt and Guy Kawasaki. The document provides tips for setting up an account on SlideShare, uploading content, optimizing it for searchability, and sharing it on social media to build an audience and reputation as a subject matter expert.
Viewers also liked (9)
Bitcoin and Blockchain Technology Explained: Not just Cryptocurrencies, Econo...
Bitcoin and Blockchain Technology Explained: Not just Cryptocurrencies, Econo...
Similar to Complementing static and dynamic analysis approaches for better
Security Automation Quick Wins - Siemplify Webinar
This document discusses security automation and provides examples of processes that can be automated. It notes that 96% of respondents have security orchestration projects underway to automate manual tasks. The top areas ripe for automation include data collection/enrichment, triage of low fidelity alerts, and establishing consistent processes. The document then provides examples of automation workflows that can be used for common security issues like phishing, malware, DLP, and account misuse. These examples outline steps that can be automated, like data gathering, analysis, response, and feedback.
Security Analytics for Data Discovery - Closing the SIEM Gap
This document discusses security analytics and hunting maturity. It defines hunting as a proactive approach to identifying incidents by actively looking for patterns, intelligence or hunches, rather than waiting for notifications. It describes the "SIEM gap" where SIEM tools are designed for known threats and lack the tools and flexibility for human analysis and hunting of unknown threats. It outlines techniques used in security analytics like event clustering, association analysis, and visualization to help analyze large datasets and discover unknown threats. The document argues security analytics provides the data access, analysis techniques and workflows to help close the SIEM gap and improve an organization's hunting maturity over time.
Sasa milic, cisco advanced malware protection
Cisco Advanced Malware Protection uses a combination of techniques including signatures, machine learning, dynamic analysis, and behavioral analytics to both prevent known threats and detect previously unknown threats retrospectively. It provides security for networks, endpoints, and mobile devices through a cloud-based platform that shares threat intelligence between Cisco and its customers.
Computer Forensics
This document discusses computer forensics and outlines best practices for evidence collection, analysis, and reporting. It defines key terms like evidence, chain of custody, and imaging. It emphasizes the importance of planning, minimizing data loss, documenting all actions, and analyzing all collected data to ensure the integrity of the forensic investigation process.
Blackhat 2018 - The New Pentest? Rise of the Compromise Assessment
The document discusses compromise assessments, which are proactive evaluations of systems to detect threats that have evaded existing security controls. A compromise assessment is faster, more affordable, and independent compared to traditional vulnerability assessments and penetration tests. The assessment methodology involves planning, preparation, discovery, collection of data from endpoints, analysis of the collected data using techniques like forensic state analysis, and reporting of findings. It is recommended that organizations conduct regular compromise assessments by a third party to validate network security and detect any unauthorized access.
The New Pentest? Rise of the Compromise Assessment
If an attacker had a foothold in your network today, would you know it?
If they made it past your real-time defense measures (EDR, EPP, AV, UEBA, firewalls, etc.) or an analyst misinterpreted a critical alert, chances are they've entrenched themselves for the long haul. Skilled and organized attackers know long-term persistence in your network is the most critical component to meeting their goal of stealing information, causing damage, or pivoting attacks on other organizations.
Threat hunting is the proactive practice of finding attackers in your environment before they can cause damage (or at least stop the bleeding from continued exposure). Unfortunately, effective threat hunting practices remain out-of-reach for most organizations due to lack of security infrastructure and qualified people to manage advanced endpoint security solutions.
One solution to this problem is to hire a third party to conduct a periodic assessment geared toward discovery of unauthorized access and compromised systems. This is called a "compromise assessment" and just recently compromise assessments have become one of the most requested services from top security service providers.
Customers don’t want to just know if they can be hacked (a good penetration tester will generally conclude “yes”) they want to know if they ARE hacked—right now—and if so, what endpoints/hosts/servers on their network are compromised.
In this presentation, which was originally prepared for Black Hat 2018, Chris Gerritz outlines the growing practice of compromise assessments and the best practices being utilized by some of the largest and most sophisticated managed security service providers (MSSPs) with this offering.
What approaches are most effective?
What data is being utilized?
What are some of the top challenges?
To request a free 100-node compromise assessment or to learn more about Infocyte HUNT — our comprehensive threat hunting platform — and start a free trial, please visit https://try.infocyte.com.
Automatic test packet generation
This document discusses Automatic Test Packet Generation (ATPG), which automatically generates test packets to check the health and functionality of a network. It aims to detect common network failures like hardware failures, software bugs, reachability issues, and performance degradation. The ATPG system works by performing reachability analysis to determine all possible packet flows, generating a minimum set of test packets to exercise the entire rule set, and using the results to localize any faults by eliminating passing rules and identifying broken ones. Implementing ATPG could provide more efficient network testing than current tools like ping and traceroute, helping reduce downtime and costs associated with network outages.
detection and classification of malware.pptx
The document presents a technique for detecting and classifying self-deleting malware using Windows Prefetch files. It trains a KNN classifier to detect malware execution based on prefetch file features. It then applies a Jaccard similarity classifier to attribute the malware to a family. The approach extracts features from over 4,000 malware and benign prefetch files, applies normalization to select relevant features, trains the KNN detector, and uses minimum family features and Jaccard similarity to classify into 48 malware families. The technique can detect malware execution and attribute it to a family using only prefetch file evidence, without accessing the original malware sample.
Similar to Complementing static and dynamic analysis approaches for better (8)
Security Automation Quick Wins - Siemplify Webinar
Security Automation Quick Wins - Siemplify Webinar
Security Analytics for Data Discovery - Closing the SIEM Gap
Security Analytics for Data Discovery - Closing the SIEM Gap
Blackhat 2018 - The New Pentest? Rise of the Compromise Assessment
Blackhat 2018 - The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise Assessment
The New Pentest? Rise of the Compromise Assessment
Recently uploaded
Empowering Growth with Best Software Development Company in Noida - Deuglo
Do you want Software for your Business? Visit Deuglo
Deuglo has top Software Developers in India. They are experts in software development and help design and create custom Software solutions.
Deuglo follows seven steps methods for delivering their services to their customers. They called it the Software development life cycle process (SDLC).
Requirement — Collecting the Requirements is the first Phase in the SSLC process.
Feasibility Study — after completing the requirement process they move to the design phase.
Design — in this phase, they start designing the software.
Coding — when designing is completed, the developers start coding for the software.
Testing — in this phase when the coding of the software is done the testing team will start testing.
Installation — after completion of testing, the application opens to the live server and launches!
Maintenance — after completing the software development, customers start using the software.
Vitthal Shirke Java Microservices Resume.pdf
Software Engineering, Software Consulting, Tech Lead, Spring Boot, Spring Cloud, Spring Core, Spring JDBC, Spring Transaction, Spring MVC, OpenShift Cloud Platform, Kafka, REST, SOAP, LLD & HLD.
Transform Your Communication with Cloud-Based IVR Solutions
Discover the power of Cloud-Based IVR Solutions to streamline communication processes. Embrace scalability and cost-efficiency while enhancing customer experiences with features like automated call routing and voice recognition. Accessible from anywhere, these solutions integrate seamlessly with existing systems, providing real-time analytics for continuous improvement. Revolutionize your communication strategy today with Cloud-Based IVR Solutions. Learn more at: https://thesmspoint.com/channel/cloud-telephony
LORRAINE ANDREI_LEQUIGAN_HOW TO USE ZOOM
Zoom is a comprehensive platform designed to connect individuals and teams efficiently. With its user-friendly interface and powerful features, Zoom has become a go-to solution for virtual communication and collaboration. It offers a range of tools, including virtual meetings, team chat, VoIP phone systems, online whiteboards, and AI companions, to streamline workflows and enhance productivity.
May Marketo Masterclass, London MUG May 22 2024.pdf
Can't make Adobe Summit in Vegas? No sweat because the EMEA Marketo Engage Champions are coming to London to share their Summit sessions, insights and more!
This is a MUG with a twist you don't want to miss.
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
https://2024.springio.net/sessions/automated-software-refactoring-with-openrewrite-and-generative-ai/
socradar-q1-2024-aviation-industry-report.pdf
SOCRadar's Aviation Industry Q1 Incident Report is out now!
The aviation industry has always been a prime target for cybercriminals due to its critical infrastructure and high stakes. In the first quarter of 2024, the sector faced an alarming surge in cybersecurity threats, revealing its vulnerabilities and the relentless sophistication of cyber attackers.
SOCRadar’s Aviation Industry, Quarterly Incident Report, provides an in-depth analysis of these threats, detected and examined through our extensive monitoring of hacker forums, Telegram channels, and dark web platforms.
Enterprise Resource Planning System in Telangana
Enterprise Resource Planning System includes various modules that reduce any business's workload. Additionally, it organizes the workflows, which drives towards enhancing productivity. Here are a detailed explanation of the ERP modules. Going through the points will help you understand how the software is changing the work dynamics.
To know more details here: https://blogs.nyggs.com/nyggs/enterprise-resource-planning-erp-system-modules/
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Dr. Jesús Barrasa, Head of Solutions Architecture for EMEA, Neo4j
Découvrez les dernières innovations de Neo4j, et notamment les dernières intégrations cloud et les améliorations produits qui font de Neo4j un choix essentiel pour les développeurs qui créent des applications avec des données interconnectées et de l’IA générative.
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Discover the essential features to incorporate in your Winzo clone app to boost business growth, enhance user engagement, and drive revenue. Learn how to create a compelling gaming experience that stands out in the competitive market.
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
No one wants their application to drag like a car stuck in the slow lane! Yet it’s all too common to encounter bumpy, pothole-filled solutions that slow the speed of any application. Symfony apps are not an exception.
In this talk, I will take you for a spin around the performance racetrack. We’ll explore common pitfalls - those hidden potholes on your application that can cause unexpected slowdowns. Learn how to spot these performance bumps early, and more importantly, how to navigate around them to keep your application running at top speed.
We will focus in particular on tuning your engine at the application level, making the right adjustments to ensure that your system responds like a well-oiled, high-performance race car.
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
The UI5 tooling is the development and build tooling of UI5. It is built in a modular and extensible way so that it can be easily extended by your needs. This session will showcase various tooling extensions which can boost your development experience by far so that you can really work offline, transpile your code in your project to use even newer versions of EcmaScript (than 2022 which is supported right now by the UI5 tooling), consume any npm package of your choice in your project, using different kind of proxies, and even stitching UI5 projects during development together to mimic your target environment.
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Crescat is industry-trusted event management software, built by event professionals for event professionals. Founded in 2017, we have three key products tailored for the live event industry.
Crescat Event for concert promoters and event agencies. Crescat Venue for music venues, conference centers, wedding venues, concert halls and more. And Crescat Festival for festivals, conferences and complex events.
With a wide range of popular features such as event scheduling, shift management, volunteer and crew coordination, artist booking and much more, Crescat is designed for customisation and ease-of-use.
Over 125,000 events have been planned in Crescat and with hundreds of customers of all shapes and sizes, from boutique event agencies through to international concert promoters, Crescat is rigged for success. What's more, we highly value feedback from our users and we are constantly improving our software with updates, new features and improvements.
If you plan events, run a venue or produce festivals and you're looking for ways to make your life easier, then we have a solution for you. Try our software for free or schedule a no-obligation demo with one of our product specialists today at crescat.io
How to write a program in any programming language
How to write a program in any programming language
Graspan: A Big Data System for Big Code Analysis
We built a disk-based parallel graph system, Graspan, that uses a novel edge-pair centric computation model to compute dynamic transitive closures on very large program graphs.
We implement context-sensitive pointer/alias and dataflow analyses on Graspan. An evaluation of these analyses on large codebases such as Linux shows that their Graspan implementations scale to millions of lines of code and are much simpler than their original implementations.
These analyses were used to augment the existing checkers; these augmented checkers found 132 new NULL pointer bugs and 1308 unnecessary NULL tests in Linux 4.4.0-rc5, PostgreSQL 8.3.9, and Apache httpd 2.2.18.
- Accepted in ASPLOS ‘17, Xi’an, China.
- Featured in the tutorial, Systemized Program Analyses: A Big Data Perspective on Static Analysis Scalability, ASPLOS ‘17.
- Invited for presentation at SoCal PLS ‘16.
- Invited for poster presentation at PLDI SRC ‘16.
E-commerce Application Development Company.pdf
Your business can reach new heights with our assistance as we design solutions that are specifically appropriate for your goals and vision. Our eCommerce application solutions can digitally coordinate all retail operations processes to meet the demands of the marketplace while maintaining business continuity.
LORRAINE ANDREI_LEQUIGAN_HOW TO USE WHATSAPP.pptx
WhatsApp offers simple, reliable, and private messaging and calling services for free worldwide. With end-to-end encryption, your personal messages and calls are secure, ensuring only you and the recipient can access them. Enjoy voice and video calls to stay connected with loved ones or colleagues. Express yourself using stickers, GIFs, or by sharing moments on Status. WhatsApp Business enables global customer outreach, facilitating sales growth and relationship building through showcasing products and services. Stay connected effortlessly with group chats for planning outings with friends or staying updated on family conversations.
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Allez au-delà du battage médiatique autour de l’IA et découvrez des techniques pratiques pour utiliser l’IA de manière responsable à travers les données de votre organisation. Explorez comment utiliser les graphes de connaissances pour augmenter la précision, la transparence et la capacité d’explication dans les systèmes d’IA générative. Vous partirez avec une expérience pratique combinant les relations entre les données et les LLM pour apporter du contexte spécifique à votre domaine et améliorer votre raisonnement.
Amenez votre ordinateur portable et nous vous guiderons sur la mise en place de votre propre pile d’IA générative, en vous fournissant des exemples pratiques et codés pour démarrer en quelques minutes.
GraphSummit Paris - The art of the possible with Graph Technology
Sudhir Hasbe, Chief Product Officer, Neo4j
Join us as we explore breakthrough innovations enabled by interconnected data and AI. Discover firsthand how organizations use relationships in data to uncover contextual insights and solve our most pressing challenges – from optimizing supply chains, detecting fraud, and improving customer experiences to accelerating drug discoveries.
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers. This video you can watch from my youtube channel at https://youtu.be/m-F-mZA3MkU
Recently uploaded (20)
Empowering Growth with Best Software Development Company in Noida - Deuglo
Empowering Growth with Best Software Development Company in Noida - Deuglo
Transform Your Communication with Cloud-Based IVR Solutions
Transform Your Communication with Cloud-Based IVR Solutions
May Marketo Masterclass, London MUG May 22 2024.pdf
May Marketo Masterclass, London MUG May 22 2024.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Automated software refactoring with OpenRewrite and Generative AI.pptx.pdf
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Neo4j - Product Vision and Knowledge Graphs - GraphSummit Paris
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Top Features to Include in Your Winzo Clone App for Business Growth (4).pptx
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
Need for Speed: Removing speed bumps from your Symfony projects ⚡️
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
UI5con 2024 - Boost Your Development Experience with UI5 Tooling Extensions
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
Introducing Crescat - Event Management Software for Venues, Festivals and Eve...
How to write a program in any programming language
How to write a program in any programming language
Atelier - Innover avec l’IA Générative et les graphes de connaissances
Atelier - Innover avec l’IA Générative et les graphes de connaissances
GraphSummit Paris - The art of the possible with Graph Technology
GraphSummit Paris - The art of the possible with Graph Technology
Oracle Database 19c New Features for DBAs and Developers.pptx
Oracle Database 19c New Features for DBAs and Developers.pptx
Complementing static and dynamic analysis approaches for better
- 1. Complementing Static And Dynamic Analysis Approaches For Better Network Defense Himanshu Pareek Fast Abstract @ DSN 2013
- 2. Challenges For Network Level Defense Dynamic Heuristic(or Emulation) based Detection Static Heuristics based Detection Signature based Detection False Negative Rate, Efficient Approach for Network Level Scanning Extract a file, packets are queued and dynamic analysis is to be carried out Not a good idea Lower FN Rate, but will take longer time to mature than dynamic analysis Can not rely for a significant time Good for Prevention Might be used for detection Good for detection Zero FN Rate is achievable in short time span
- 3. Time Line of Solutions available
- 4. Complementary Approach Static Heuristics based Detection Dynamic Heuristic(or Emulation) based Detection 1. Re Assemble The File 2. Analyze Invoke if Required Generally When File is Detected as Suspicious
- 5. Internal Host Gateway Packets are forwarded Last Packet File Reconstruction Last Packet Dropped Packets Drop Last Packet Static Analysis Perform File is Benign, Suspicious or Malicious
- 6. Components in Complementary Approach • Host Agent • Dynamic Analyzer • Static Analyzer • Gateway Controller
- 7. The Tagging Gateway Dynamic Analyzer Static Analyzer 1. File Request 2. File Response 3. Static Analysis Request and Response 4. File Tag from Static Analysis 5. Dynamic Analysis Request and Response 6. File Tag from Dynamic Analysis Agent