women I'm kinda sorta vision software engineering institute Carnegie Mellon
University on the situation awareness team and general analyst trainee
researcher myself to be a lot of people think about the problems of the
conversation and bottom out an indicator where customers can tell lies they tell
me about the state of the law normally detection me anomaly detection versus
signature detection thinking about this and I think this really comes down to
where a lot of the people who are you don't necessarily have a good
understanding of what he is just what I see no trades
let's talk about that a little bit today but more quietly what I wanna do as I'm
gonna find you as an analyst we are in discussions that don't believe how fast
your job so I'm gonna present a way that I have come to you and start to think
about even in ways I can come out and help me find someone talked about was
security use a series of actions I'm ready to one event is not just have one
of a number of security landscape that's made up of many devices computer
components of your reputation is going through security landscape
the impact of these contacts didn't hear you by events are not just actions are
you free that's not an event to event is part of what makes the security men and
some reactions causes harm in some manner is very much an organisation
people
not seem man in a few different depending on the organization for
instance not over realizations standing as a teacher Thomas just something that
happens it's really big deal when I think about a fence organizations have a
good handle on how to respond to numb your friends but a little bit harder
when it comes to hunting for you don't have an alert to earlier today what's on
our presentation of Pope wear either those types of organizations once I
haven't action ones that don't know they can we don't know you can check that's
really hard training analyst position because we don't know and no you don't
aren't told what we should be looking for told that we should be looking for
something to think about when we want to hunt
to identify people care about so do we care about this game is that we're gonna
hunt usually more than incident response team activity and filtration approved
for us and for our organization and we care about the we need to go hunting for
you know that when you start identifying be that make up the S&P analyst finance
event in our dogs are under since nineteen architecture you know the
actions
a lot of those actions make up with jim DeMint communications or as well which
would not be an event so friends and when you have a tax increase in network
traffic and you can see the Network Time wow does not have legitimate chance to
even hear what is it that the actions of an attack would indicate that something
is legitimate identified that
but the ones that are most likely to meet likely to be legitimate it's not
looking for those actions first assuming you actually have a century architecture
history behind the action really want to get a hearing for an analyst we need to
define investigate the actions so we don't say that an associate professor
attack somebody just got a large number name use your idea to tend to track each
server to do know its stars Nina communication start opens communities
ever since potentials get messages repeat some number of times that would
be a set of actions that would define the S et tu brute force attack in
addition don't define you can't blame user policy is taken mister next year's
slides his examples the National Center for Education Statistics and they're
simple Acceptable Use Agreement policy organizations will do fine
events
based on intense not intentionally seek information on WoW intent and delicious
of an attention getter in concrete and used for commercial purposes is
prohibited content can you intend estimate based on most definitely happy
to have this subtitle types of events that are definitions that are arbitrary
disabuse
generative what is an inappropriate text as determined by the system
administrator that is very subjective matters I'm sure we have the analysts
need or something closer to the still doesn't get down to rubble where we
analyzed and optimized Association of software games attributed establishing
that were internet connections are things that we as investors start to
work with because we have a good understanding of what this actually mean
so it's especially workshop do as I'm going to talk about and that means an
indicator that talked about how I like to think of designing new men's swim
more accurately the actions that make up my mind there's something that I am
as of right now calling the definition matrix and then I'm going to social
discussion where I had there on the back seats on each side of the room and he
want to get one can you don't you don't need one to society's recession of
actually applying the initial consult a tax refunds based on generic landscape
landscape in any organisation has a landscape landscape is made up of
different this is very generic but it gives you a pretty good idea when that
weren't any number of organizations companies with assets we have devices
that users interact with users will have to provide services
users may or may not interact with this drug and devices that can sign
writers
users themselves which are also in addition reputation isn't something I
normally people but it really is and if you don't really think about this group
grade you were in addition to our nation and in some cases like me and you and
it's so maybe you can you email Twitter
wanted to send given no description of the next one of the actions and makeup
and beauty and 20 P Town service attack I just ate something like a response
volume and coming back to one ratio that you can do the same thing with the same
thing when
and i no description and could be enacted when I G address can contact the
DNS server but it doesn't use in know the answer just don't really know
but it does set of characteristics and isn't expected behavior and i no
deviation you might have something like the device supports me think of you and
applications do not indicate yes and and the location there may not be an actual
party triggered by Martin characters 16 may actually provide replications of
action
prices for packet capture picture backgrounds for your network and see
what it does when we did when we make our definitions based on the actions we
have to make our definitions used in a region defined we can't use the detailed
real-time an end up if he only the most basic skills and location in Windows she
indicated by the author
go back it's pretty basic kitchen when we gonna look for security events will
not be able to do we need to think of what we want to find once you've done
that we can identify the actions of what are identified and actions that are
least likely to be legitimate and then build some sort of definition pretty
sure those actions its definitions 10 be one of these six types so I'm going to
give an example and then I would like it if not I'm not really sure that I have
anything hours
season started this time since you can say yes
simple never did you can sample the data you may only get us your sensor me only
pick up information maybe 100 closed as not very useful if you're interested you
need to cheat in fact occur while you only got one one-hundredth of your data
how do you know that your event not occur in the other 99% of your data is
another way to see a friend and that is that instead of complete in which he is
somebody is going to be off because it only seen it so you may have you may
have a communications and media I sent you tend to get that if I might simply
run out of a hundred
11 out of 10 jacket I'm not gonna see that I sent you want I'm not gonna know
that I am what I received a record of everything ok
unidirectional in other words I sent you that's one load you send your responses
back to me that's another slow their space you can put the clothes together
and see which side had more communications and it gives me more than
I sent you I don't know that in a home where does so just stick with their
unidirectional sessions but either way actually works he just doesn't know the
difference
definitions you don't you don't finish it appropriately there are other
variations file does not have the same kills it depends on the quality is never
closed the store the network low probably need to use to analyze it
almost
included the source and destination IP addresses and ports of call later we
start time and duration but you can calculate ICMP type the code
and a 94 this discussion will include don't break out between initial
inspection center scene which network programs will call I like it when they
break it up
financial system helps you understand specialty turkey he started the
community he said and not an act you know that person that side started a
communication device itself
sensor location that's very important because that challenge you will only see
it on your border and see a different set of actions and if you see internally
specially if you have between 7-8 in our discussion that all riders landscape as
you actually have a picture and he was picking up their back there and not sure
if there's a hard cock there's an electronic copy at this point are not
forcing areas I am really do you guys think about each of these scenarios but
with the atoms be and how would you define this action tomorrow with his
speech group course alert
obviously there's something always a picture in time which is sometimes it
came across a blog post or your boss 21 cents I heard about this thing what
happened
proposal learn what would be the actions you want to get together on the other
hand maybe I'm just starting out you
so you could see the flood was a two different locations
flow at the first order reaction would be wow we know that there's going to be
a sense since then you're going to have another slow the first time it is going
to be a call when you know that eventually is going to be repeated to
get me some one direction one side and behinds 1771 gonna have hired by
would be less likely to indicate legitimate circumstances one of the
biggest problem this one where we have a set of actions define them accurately by
a lot of things like this so which will be held me tight read in germany circa
2001 things about you missed the stage for stuart is the actions so we have
going on line looks like going back a number of packages gonna have a number
but it will probably gonna have that repeated a lot of times because you're
gonna have a failed attempts
eventually see how to start again most servers home
32 started trying even if they don't actually gonna have it may be trying
times
go back here and we think that is an action involves an accent walls and
actor when I say I don't necessarily mean a person means something like it's
a itself is a machine
usually on behalf of a person
location so format irons actually coming to the US for having been worried about
what would have to happen first of all we have to be more specific about how
we're very minimal wear what we wanted to be i dont selling a tight but how we
wanted to spreading center how do we how does the box say that we get it
so then you get inspected by a spam bot what are some reactions will be the
first action that would have to cover for you to eventually have gone by
you can't really see anywhere is better
created the case people scream and did well that's me and so he reads it sends
it somewhere which is asked to go through her around our house to relay it
so that connection then it goes to the firewall the last few action is another
hour and then get it has to be rerouted action gonna get somewhere where it gets
so that our kitchen has a project that action and from there you know you don't
want to have a set of actions actions disregard that only happened at work
flow would be most likely to indicate that this is not legitimate if we have
any action that would be most likely to indicate that this is not legitimate
if we don't have the wrong on our website what would be the next like
reaction that would be nice to know that this is an event
is there anything I would have used to infer maybe there was some bad news came
out maybe
what would be the first to be 1014 insider threat actual external so what
would be the actions that we would expect to see so now in town fam hey I
have a dentist or maybe my database server and the corner so for this
particular and exercise I'm going to look for data that is moving from the
database server when it should be a good thing about let's hope it's moving from
the database everyone I should be what does that mean what would be some
possible actions wow it could be somebody who is not user ID is not
authorized
the database server where to download the database server because of trying
something like the root server is restrained at out why is the root user
restrained and that was six months and most scenarios I cannot imagine movies
434
there will be some other ways that we could define that we have to find the
action of being removed from the database server
somebody who normally post down as would all be ways that he had actually time
for this particular change your perception thereof as I can help
investigate almost hostilities is based on somebody's doing a lot of data that
makes it easier to find indication end networks so we taking action and one of
the indication that it feels that there's a lot of data that is an odd
reason
trend on our network flow between different addresses and start thinking
about ok and try when does it change the change that would be probably one of the
ways of start looking so scarce again because no one really isn't very
descriptive there's very limited
characteristics that we can work out their dream job actual actions that any
of those characteristics and still going to be a little hard to really like
certainty and that were close but it's gonna get her closer to him into what it
is and even an error search
is what I have high-level data like that one can use to search for an out and
narrowing down my search so I know right at the network level of the Jacksonville
like that of other things will too but then I've just got down 90% the traffic
but I need to look at the ideas and I need to investigate further then you can
go down and run down into more detail ball and you've already been able to
around a lot
so there's no way to be certain people tell them to look what are some things
here and do what are some of the actors even expect to see it differently from
that might indicate
because
it's really important to understand what's going on here in our normal
routine and not only that actually understand the actual layout of your
network so it really helps me know that you have the section over here that has
his forces and their you tonight is down here these are my servers I don't like
what I see so you don't even have that level of detail because they have made
some really nice network diagram time they don't have to the network diagram
of the update and then have to come up with ways to get around so they may also
be
be a number and signature I often see people don't understand how they overlap
or don't know and I'm sorry you really think about it is just anything
unexpected places I think it turns some sort of characteristics that define and
there is some overlap and organizations don't realize that those saying give me
something that is not only to talk to detection products because I already
have entered into action I noticed that a lot of things that are labeled as an
object detection really do their anomaly detection based on teenagers get into
the bed to the round where they're starting to actually deal with TV so I
really high chance to turn away from that terminology and thinking about it
turns out that something that I find events based on description
at least when I get the requirements I don't work internally in nineteen
customers give us a presenting this comes twice then not interested they
don't talk about it that way they also talked about senators and anomaly is
sometimes really when they mean when they say and only today means something
that's new do they mean some deviation not always here and sometimes even when
the team document will be talking using a team wants me two different things
because they don't understand the concept and I exactly yes I think we
should have a way to get them to move away from that a little bit and make our
job a little easier to maintain started pressing them more ok so first of all
how to find me
what is it that you don't tell me that you care about you more details you care
about internal and external access to care about any large amount of data
being with your network more only offer specific highest ranking US and China
India and impact the adverse event is adversely impacted cracks in their mind
really helps assisting in the west to the actions that we might actually find
an unsecured
going to come down so and I am very concept makes sense and it's ok
everything out there are you should check out what protocol eventually gonna
get down to business where data where to start and close all have the same sort
of character is very hard but she did you get the same thing if you can
actually get your data really I think about you only to see that all this is
when things are wrapping all the same thing happened to me maybe there's other
things happening but there's a
characteristic that you're talking about network slow they have the same range by
your range time range that's fine you can start signing starts against st. are
these related or the same attack is a bigger eventually it might be good to be
able to start the machine learning yes
good when she can induce an expense on most networks you probably know that
it's subtitle ok fine just pointed it at that point it's not good at least you
can start a family and driving drinking problems is when obviously come in to
authorities and now you need to determine what's normal
well that's not all maybe the fact that you are already compromised and we have
no way to check it out I don't know the answer to that question i my hypothesis
and I started playing around with this kind of area town gotta try not to
actually see any results are be able to sit here is that each of you to think
she needs a comparative basis to themselves over time and you need to
compare devices consumer devices when you gonna be able to start seen
differences go to my own historical behaviour change and reply if I'm
supposed to be doing the same thing as you going to have two different views in
20
so don't understand or don't have the ability to ensure their network in the
way that answers the questions they wanted to get in though I think the
basic problem that is that a lot of our customers and whether there whether the
government as we are enough apart easy do occasionally have commercial
customers is that they weren't so where did they needed to answer the questions
that there now now when asked should have no way of getting so when you have
events and actually turned out to be
they don't understand that each action has workstation quality need to see
actions you need something that tells you that we leave that to you as well as
they look at logs and then look at login or from a performance perspective ok
where I belong to monitor my performance when am I not at the wall to not
entirely wrong in his exclusive watching gives you too much information deposits
so there's a lot of reasons for organizations not to love and they don't
understand the reasons why they should be and where they should lock from a
security perspective
it does imply that this number implies that there are even no matter how well
we are skilled are certain things that you're never gonna be able to tell and
it's really frustrating and analyze when we have my station management come to us
and say but what about the false positive rate you just give me something
where everything works
as an analyst but sometimes you run across concept while but I don't have
the ability to spell potato you need wow you manage that are there some ways it
can go outside and what is based on how we use it and then there are so many
ways to treat you like a gesture there are some simple data
so yes we're short and I think that's an open source projects but when we
actually have access to services and she said there are some others I'm not sure
that there are three in a row in street so we have a balance problems very
helpful