The document discusses operationalizing big data security analytics. It notes that attackers are fast while defenders are slow, with many security alerts overwhelming analysts. A standard rules-based approach to detecting anomalies is challenged by abnormalities appearing normal. The document proposes a probabilistic approach that models both normal and abnormal distributions to better detect anomalies. It describes using behavioral risk scoring to quantify suspicious user activities and entity risk aggregation to distill billions of events into a handful of prioritized leads for further analysis.

1. 1 | © 2018 Interset Software
How to Operationalize
Big Data Security
Analytics
Mario Daigle
VP of Product

2. 2 | © 2018 Interset Software
About Interset.AI
SECURITY ANALYTICS
LEADER
PARTNE
RS
ABOUT US
Data science & analytics
focused on cybersecurity
100 person-years of
security analytics and
anomaly detection R&D
Offices in Ottawa, Canada
and Newport Beach, CA
In-Q-Tel Portfolio Company
Interset.AI

3. 3 | © 2018 Interset Software
Attackers are Fast
Defenders are Slow
Alert Overload
AV-test.org, 2015
64% of US companies
face 10,000+ alerts
per month
203 Days - Breaches
take on average 80
days to discover and
123 days to resolve
60%
of data is
stolen in
hours
54%
Of breaches
remain
undiscovere
d after 6
months
Ponemon Institute, 2015
Missed Incidents
8% of incidents are
detected by endpoint,
firewall & network
solutions
Verizon DBIR, 2014
Problem Domain: Drowning in Data and Missing Incidents
1%
SIEM

4. 4 | © 2018 Interset Software
Standard Approach – Rules and Thresholds
Source: A Pattern for Increased Monitoring for Intellectual Property
Theft by Departing Insiders, Andrew Moore, Carnegie Mellon 2011

5. 5 | © 2018 Interset Software
The Threshold Approach Challenge
Abnormal
Normal

6. 6 | © 2018 Interset Software
The Threshold Approach Challenge
Abnormal
Normal

7. 7 | © 2018 Interset Software
The Threshold Approach Challenge
Abnormal
Normal

8. 8 | © 2018 Interset Software
A Probabilistic Approach
• Computes probability that a value in a
given hour is anomalous
• Explicitly models both normal and
abnormal distributions
• Estimators for both normal and
abnormal based on observation
• Baseline “Unique Normal” and
measure deviations

9. 9 | © 2018 Interset Software
USB drives are marked as
high risk method
Method
The volume of copying is large, compared
to John’s past 30 days and
compared to other sysadmins
Activity
John Sneakypants is a
contractor and sysadmin
with privileged access
User/Machine
These files have a high risk
and importance value
Asset
Behavioral Risk: Quantifying Suspicious Events
John Sneakypants is copying an unusually large number of
sensitive files to an external USB drive.

10. 10 | © 2018 Interset Software
Entity Risk: Distilling Evidence to Find Leads
Activity
User/Machine Asset Method
Behavioral
Risk Score
User
Asset
Machine
OWASP
Risk = Likelihood * Impact

11. 11 | © 2018 Interset Software
Activity
User/Machine Asset Method
Behavioral
Risk Score
User
Asset
Machine
Entity Risk: Distilling Evidence to Find Leads
• Ann Funderburk works at an unusual hour 15
• … and accesses repositories that she and her peers do not usually access 65
• … and takes from a folder on a repository an unusual number of times 80
• … and moves a significantly high volume of data than normal 96
• … VPNs in from China 46

12. 12 | © 2018 Interset Software
Data
Repository
Logs
Active Directory
Logs
VPN
Logs
Feature Extraction
Ann moves a significant volume of
data
Ann access and takes from file
folders
Ann accesses anomalous
repositories
Ann logs in from anomalous
location
Ann logs in at unusual time of
day
(other features)
(other features)
(other features)
∑
Anomaly Detection
Auth./Access
Anomaly Model
File Access &
Usage Models
Volumetric Models
VPN Anomaly
Models
Entity Risk Aggregation
Entities
- Account
- Machine
- File
- Application
96
Mathematical Framework

13. 13 | © 2018 Interset Software
Distill billions of events into a handful of prioritized threat leads
A Handful of Prioritized Threat LeadsBillions of Events Hundreds of Anomalies

14. 14 | © 2018 Interset Software
Technology Demonstration

15. 15 | © 2018 Interset Software
15 | © 2018 Interset Software
QUESTIONS?
Mario Daigle
mdaigle@interest.com
@mariodaigle
613.882.6955
Learn more at Interset.AI