scikit-learn, machine learning and cybercrime attribution
summary
Uses scikit-learn and custom pipelines to extract text and character n‑gram features and cluster phishing sites, then ensembles many parameter sets with an EAC remapping to pick cluster counts automatically. Claims clustering reveals actor groups (e.g. Rockfish) and correlates with known takedowns, reports ~99% purity against expert labels and roughly 70% automated accuracy for cluster separation. Implements this in Python, notes online learning is not yet provided.
AI-written summary · about
chapters (19)
- 0:00Intro
- 0:51Hats
- 5:59Code breakdown
- 6:30Main Features
- 8:10Tutorial - astroML
- 9:36What does data look like?
- 11:34Supervised/Unsupervised
- 13:30Example for classification
- 14:36Different Classification Algorithms
- 15:32Supervised Learning: Regression
- 16:28Example for regression
- 16:52Unsupervised learning: Clustering Kmeans clustering on the digits dataset (PCA reduced data) Centroids are marked with white cross
- 17:56Example for clustering
- 18:22Different Clustering Algorithms
- 18:54Why use scikit-learn?
- 21:01Contributing
- 21:29Authorship Attribution for Indirect Attribution For attacks with written documents, we can use authorship analysis to map the authorship patterns.
- 22:14Phishing Website Authorship
- 23:57Basic Procedure
related talks
44mApplied Machine Learning for Data Exfil and Other Fun Topics
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack
30mBuilding a Predictive Pipeline to Rapidly Detect Phishing Domains
51mDeepPhish: Simulating Malicious AI
51mDeepPhish: Simulating Malicious AI
31mAI-Powered Solutions for Cybersecurity
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution