Early Detection Of Malicious Patterns In Event-Streaming Data
summary
An open-source Event Query Language parses JSON event streams into process-centered sequences and makes hunting rules runnable; a sequence GRU model embeds event types plus character-histogram path vectors and scores maliciousness. The model trains on about 1,000,000 benign / 120 ransomware sequences, initially detects ~2/3 of ransomware at a 1:100 false-positive rate and needs ~65 events for 95% detection; a variant that looks across the whole history drops early detection to ~2 file writes and yields compact EQL rules that match ransomware behaviors with explainable, deployable queries.
AI-written summary · about
chapters (9)
- 0:00Introduction and overview
- 5:20Introducing Event Query Language
- 11:31EQL use cases and examples
- 18:36Machine learning for malicious patterns
- 24:45Clarifying AI vs machine learning
- 31:08Training the ransomware detection model
- 34:21Improving early detection with ML
- 41:05Summary and key takeaways
- 43:36Q&A session
related talks
36mA Graph-based Machine Learning early warning system to detect Ransomware
31mUNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
30mTrawling for IOCs: Catching C2 in a Sea of Data
40mRansomware: Creation, Detection, and Response
47mWorm Charming: Harvesting Malware Lures for Fun and Profit
33mLiving with Ransomware - The New Normal in Cyber Security
30mData Driven Security
30mSpotting Threats with Elastic SIEM