A Graph-based Machine Learning early warning system to detect Ransomware
summary
Claims a practical early warning system that flags ransomware activity by converting Windows logs into graphs and running graph ML it processes att-29 200k events from a four‑host simulation, builds account→host→event nodes, uses NetworkX closeness centrality and simple feature joins, finds distinct suspicious clusters driven by pervasive WMI activity linked to Conti and Cobalt Strike, demonstrates unsupervised detection but notes compute limits and no time‑series modeling and suggests surreal DB for streaming graph productionization
AI-written summary · about
chapters (13)
- 0:00Ransomware detection with graphs
- 2:28Ransomware attack evolution
- 5:17Ransomware attack stages
- 9:09Traditional detection limits
- 11:13Attack techniques to graph analysis
- 14:25Data sources for analysis
- 17:15Log data to graph structures
- 21:26Building the graph model
- 25:19Abnormal activity clusters
- 27:25Closeness centrality for detection
- 28:49Future directions and learning
- 30:14Ransomware protection tips
- 31:23Q&A
related talks
48mHunting Stealth Adversaries with Graphs & AI
50mEarly Detection Of Malicious Patterns In Event-Streaming Data
53mMachine Learning to Ultimately Defeat Advanced Ransomware Threats
31mUNVEIL: A Large-Scale, Automated Approach to Detecting Ransomware
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
52mRansomware; The Real Pandemic
40mRansomware: Creation, Detection, and Response
32mAI/Machine Learning: What is Actually Working in Cybersecurity?