Machine Learning Based Attack Vector Modeling for CyberSecurity
summary
Machine learning models classify DoS, recon, exploits and command‑and‑control by turning packet and aggregate logs into engineered variables like average TCP length, DNS request counts, MTU, window size and jitter variance, plus rolling-average features across days. Labeling combines manual review with assisted labeling from clustered samples. Models run alongside IDS/IPS and SOC feeds, update features weekly and deploy new models every 15 days, and an H2O-powered implementation claims throughput of 1.2 Million decisions per second.
AI-written summary · about
chapters (17)
- 0:00Intro
- 1:10Classification of Attacks
- 2:05Anatomy of An Attack - Short Term
- 3:36Anatomy of An Attack - Long Term
- 8:23Why?
- 9:10Solutions do exist. Right?
- 10:44CSec Solution Evolution
- 11:47Features - (Used in Feature-based Model)
- 13:25Source of Features
- 14:08Features - Example
- 16:43Feature-based Model: Advantages
- 17:14Successfully Classified
- 17:56Manual Labeling
- 18:25Assisted Labeling
- 19:01Model Deployment
- 19:32Model Implementation 1. Currently used to assist IDS/IPS systems in decision
- 21:04Pure Data-driven Model
related talks
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
42mAI Math Models Help Hunting Cybersecurity Threads
42m How machine learning and AI can help reduce the cyber- attacks
10mQuick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
30mData Driven Security
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
53mAI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins?
29mAttack Defense Graph Analysis for Supporting SOC and CSIRT Operations