The Other AI: How Semantic Reasoning Automates Security Analysis
•
2 likes•308 views
Semantic reasoning understands the data and makes logical conclusions the same way security analyst does. We discuss how this form of AI can revolutionize the low-level data analysis, model expert knowledge, and empower critical decision making.
Recommended
Recommended
More Related Content
What's hot
What's hot (9)
Similar to The Other AI: How Semantic Reasoning Automates Security Analysis
Similar to The Other AI: How Semantic Reasoning Automates Security Analysis (20)
Recently uploaded
Recently uploaded (20)
The Other AI: How Semantic Reasoning Automates Security Analysis
- 1. THE OTHER AI Anton Goncharov 2017-03-12 @ag0x00 How Semantic Reasoning Automates Security Analysis
- 3. DAY IN LIFE
- 4. WHAT’S IN THE BOX?!! DATA ??? “INSIGHTS”
- 5. Life of a Security Analyst
- 6. PAIN POINTS • Our current “Security Log Analytics” approach sucks • Performance and scaling issues • Overwhelming amount of data to analyze • Expensive queries • Dashboards never reveal the complete picture • Missing context • Too many false positives. Rules make too many assumptions. • Algorithms don’t understand the difference between an anomaly and a malicious intent • Zombie workflows • Not one person knows everything about the environment
- 7. Congrats. Now investigate each IP address…
- 8. And don’t even get me started on ML… (or do)
- 9. THE CORE ISSUE Our tools struggle to represent the complexity of our environments.
- 10. DATA MODELING
- 11. Efficient data modeling is an unsolved problem
- 12. https://www.forbes.com/sites/danwoods/2016/09/30/oreilly-ai-conference-roundup-success- with-ai-requires-a-mature-data-supply-chain/#334425663cc4 “So, when AI products do start showing up, who will win? In my view it is those companies who have done the best job of cataloging, cleaning, transforming, and distributing data, that is in creating a data supply chain, will have the best results from AI products.”
- 14. • Capture and represent knowledge as a network of facts • Automatically make conclusions based on these facts • Fill gaps in information provided by data • Focus on higher level problems
- 15. SOME USEFUL CONCEPTS 1. Inheritance 2. Reverse edges 3. Axioms (reasoning rules) Employee Person DoB Gender DL # DoB Gender DL # Employee ID Class Subclass Domain Host belongs to contains
- 16. Hardware Peripheral Device Printer Mobile Computer Laptop Cellular Phone Desktop Server Organization Location Has Vendor Deployed At Stationary Computer Computing Machine
- 17. RDFS + TURTLE EXAMPLE https://en.wikipedia.org/wiki/FOAF_(ontology)
- 18. AUTH EVENT AS A SUBGRAPH Attempted Authentication (event) ‘MYLAPTOP’ (host) ‘ACMEANTON’ (credential) ‘PRDSERVER’ (host) ‘ANTON’ (auth token) ’10.0.0.1’ (ip address) existson initiated by initiated from uses attempted at uses
- 19. REASONING I 1. Create a vertex or an edge that must exist Bill Me ? has uncle has parent has brother
- 20. REASONING II 2. Promote a vertex or an edge into a more specific subclass Bill Me Robert has uncle has father has brother
- 21. INFOSEC EXAMPLE installed on Vulnerability Software Release Software Installation Host contains instance of vulnerable to
- 22. HOW TO GET STARTED?
- 23. HIGH LEVEL STACK SPARQL RDF RDFS OWL Triple Store Data Store Data Model Ontology / Semantics Graph Query Language
- 24. WORD OF CAUTION • RDFS struggles with dynamic and temporal facts • OWL ontologies can get complicated
- 25. SOME USEFUL RESOURCES • Get Started Kits • Neo4j • GRAKN • Backends • Anything with Tinkerpop support • Query Languages • Cypher (neo4j) • Gremlin (tinkerpop) • Data Formats • JSON-LD (for messages) • Turtle (for ontologies)