The Security Wolf of Wall Street: Fighting Crime With High-Frequency Classification and...
summary
OpenDNS builds a real‑time pipeline that processes ~80 billion DNS queries/day by replaying S3 log chunks into an Avalanche stream framework (Python + ZeroMQ, master/8‑slave AWS cluster) that sustains ~30k messages/sec and trades occasional lost chunks for no backlog. A deployed NLP‑Rank phishing classifier combines ASN whitelists, edit‑distance heuristics, HTML TF‑IDF + LSI similarity to detect brand‑spoofing (examples hitting 90–99.9% similarity), auto‑tag/block domains, shorten analyst validation time, and supports backtesting and weekly retraining.
AI-written summary · about
chapters (11)
- 0:00Introduction and agenda
- 2:05Avalanche project overview
- 5:38Avalanche architecture
- 8:17Data processing pipeline
- 16:30Graph-oriented data mining
- 20:34NLP fraud detection
- 23:40Heuristics and language
- 29:04Content mining and models
- 38:12Detection results
- 46:48Conclusion and acknowledgments
- 48:53Q&A session
related talks
45mThe Security Wolf of Wall Street
59mCatching Malware En Masse: DNS and IP Style
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
33mIDACUT: Inspecting DNS Anomalies Crossing Uncertain Times
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
19mNames and Security
25mDark Side of the DNS Force