Build threat detection models using ML
summary
Shows a concrete pipeline that extracts fields from logs and PDFs, computes features (about 70+ features across domain, path and query), and trains classifiers on Amazon SageMaker, with SageMaker Autopilot runs 250 experiments to find the best model in hours instead of days. Demonstrations include URL DGA detection reaching high accuracy after splitting data, and PDF malware scoring where metadata size, entropy and token counts turn out to be strong signals.
AI-written summary · about
chapters (12)
- 0:00Introduction and speakers
- 1:31Limitations of traditional threat detection
- 4:05Event-driven architecture for threat detection
- 7:15Building threat detection datasets
- 10:49Key features for URL threat assessment
- 13:00Malicious PDF document detection
- 15:15Data preparation with SageMaker
- 17:20Training models with SageMaker Autopilot
- 20:12Using trained models for security analysis
- 22:24API integration and flexibility
- 23:06Essential takeaways for ML threat detection
- 27:03Q&A session
related talks
33mAt the age of AI and ML
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack
33mBuild, train, and deploy ML models using Amazon SageMaker
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
30mData Driven Security
51mProfundizando en Aprendizaje Automático para Desarrolladores
39mDetecting Website Intrusion and Account Compromise with Machine Learning
12mIntelligent Threat Detection in the Post-Quantum Era