Automated prevention of ransomware with machine learning and gpos

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID:SESSION ID:
#RSAC
Rod Soto
Automated Prevention of Ransomware
with Machine Learning and GPOs
SPO2-T11
Senior Se...

#RSAC
$Whoami
Rod Soto @rodsoto
Principal Security Researcher at Splunk UBA, former AKAMAI, Prolexic PLXSert.
Like to brea...

#RSAC
What is Ransomware?
Ransomware

#RSAC
Current state of Ransomware

#RSAC
Commonly found Ransomware IOCs
• The modification of the registry keys (Most associated with persistence. I.E
execut...

#RSAC
Enterprises challenged by Ransomware
Current mitigation technique is… paying…
Disaster Recovery & Offsite backup.
Us...

#RSAC
Ransomware Detection in the New Age
ANOMALY
DETECTION
THREAT
DETECTION
UNSUPERVISED
MACHINE LEARNING
BEHAVIOR
MODELI...

#RSAC
Automation Tools for the Enterprise
• Threat Intelligence Platforms
(TIP)
• Threat and Vulnerability
Platforms (TVM)...

#RSAC
Big Data & Machine Learning
Big Data: Synthesis of technology providing visibility into
the analysis of large data s...

#RSAC
Too Many Dimensions
Too Many Technologies Too Many Time-Slices
Too Many Statistical Methods
Too Many ML Categories
T...

#RSAC
Guerrilla Machine Learning for Cyber security
Fractal Defense: Reuse logic (and code) across different
security use ...

#RSAC
Aktaion Detection Workflow
1. Take PCAPs of known (labeled) exploits and known (labeled) benign behavior
and convert...

#RSAC
Mapping Available Data to a ML Solution
• Sweet
Spot:
Exploit
Delivery
• Ransomware
Behaviors:
– File system
Specifi...

#RSAC
Training a Random Forest to Detect Exploit Delivery
1. Initial Redirect From Poisoned Domain: [29/Apr/2015:16:52:23 ...

#RSAC
Building a Random Forest
Random forest trained on labeled malicious and
benign samples
Learning Machine
Libraries : ...

#RSAC
Radom Forest Using Splunks Machine Learning
Toolkit
The simple linear model gives us output that separates the Signa...

#RSAC
Data Sets Used To Train the Model
Open Source Examples: github.com/jzadeh/Aktaion/tree/master/data
386 Labeled Explo...

#RSAC
Aktaion Logical Workflow
AKTAION Core
Bro –r
traffic.pcap
http.log
conn.log
ssl.log
traffic.pcap
AD_IP Mime Type
10....

#RSAC
Think of Group Policy as “touch once, configure many.”
Group Policy is simply the easiest way to reach out and confi...

#RSAC
Requirements for GPOs (Overview)
The requirements for using Group Policy and following the instructions
that this wh...

#RSAC
Advantages of using GPOs
With GPOs, administrators can apply settings in granular, distributed
and expedited way. (T...

#RSAC
Security Settings node of a Group Policy object.
Account Policies (Password Policy, Account Lockout, Kerberos Auth)
...

#RSAC
Machine Learning + GPO = Active Defense.
By leveraging big data and machine learning we can
provide more granular an...

#RSAC
General Challenges using GPOs
Scope must be clearly defined. It requires system administrators to
organize user, ass...

#RSAC
Machine Learning + GPO = Active Defense.
By leveraging big data and machine learning we can provide more
granular an...

#RSAC
Proof of Concept
• Ransomware network traffic analyzed using Machine Learning open source tool: (Aktaion
- https://g...

#RSAC
Proof of Concept
Tool execution

#RSAC
Proof of Concept
Tool execution
2016-08-01 04:50:17 INFO WekaUtilities$:101 - Parsed 4 total lines.
!!!!!!!!!!!!!!!!...

#RSAC
Proof of Concept
Tool execution – Script pushes GPO into AD

#RSAC
Proof of Concept
Tool execution – GPO placed at AD

#RSAC
Proof of Concept – Further GPO actions
• Force logoff
• Remove Computer from Domain
• Disable password changes
• Dis...

#RSAC
Conclusions
• Machine Learning + Big Data technologies + GPO can
be effectively applied for active defense.
• These ...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 32 Ad

View on Slideshare

1 of 32 Ad