Thresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
summary
Credit Agricole SOC processes ~300k events/sec (≈10 TB/day, ~4 PB/yr) and tests unsupervised ML on proxy logs: 15 days (~15 GB) aggregated to daily profiles with ~71 features, modeled with an isolation forest, surfaced as top 0.5% anomaly alerts, and visualized in 3D linked to Elasticsearch. Simulated 660 exfiltration scenarios across ~30k daily behaviors and detect many exfil patterns that legacy rules miss. Pipeline is Python-based, allows whitelists and analyst feedback, and plans include autoencoders and industrialized monitoring.
AI-written summary · about
chapters (21)
- 0:00Intro
- 0:42CONTEXT
- 2:00MACHINE LEARNING IN SOC TEAM
- 3:03OOTB BEHAVIORAL ANALYTICS
- 5:18MACHINE LEARNING 101
- 6:15ISOLATION FOREST
- 7:06DEEP LEARNING: ANN
- 8:31DEEP LEARNING: AUTOENCODERS
- 9:33EXFILTRATION IS PART OF THE MATRIX
- 10:35MACHINE LEARNING (AND DS) METHODOLOGY
- 11:37LOG AND ASSOCIATED META DATA
- 12:30DATA REPRESENTATION IS KEY
- 13:29FEATURES ENGINEERING
- 15:13NOTHING'S MATHE-MAGIC
- 16:35RESULTS VISUALIZATION AKA DATAVIZ
- 20:13UNSUPERVISED MACHINE LEARNING EVALUATION
- 20:28MODEL EVALUATION: EMPIRICAL EVALUATION
- 20:47PRINCIPAL COMPONENT ANALYSIS
- 25:11CUSTOM ML DEVELOPMENT
- 26:16TAKEAWAYS
- 27:02PERSPECTIVES
related talks
42mAI Math Models Help Hunting Cybersecurity Threads
39mDetecting Website Intrusion and Account Compromise with Machine Learning
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
48mHunting Stealth Adversaries with Graphs & AI
19mThe Rise of AI in Anomaly Detection
49mFight Smarter: Accelerate Your SOC with AI Discovered Attacks
12mUnleashing the Power of AI for Performance Monitoring& Anomaly Detection
44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges