Hunting Stealth Adversaries with Graphs & AI
summary
Claims a practical pipeline that turns plain logon rows into graph-modeled lateral movement and then into anomaly scores using Sabonis extractor to produce CSVs, Neo4j + Cypher for visualization and queries, and the ds4n6 Chrysalis/Daisy VM to run ML. Uses real incident data (≈120 servers, ~10k users, ~200k–4M log entries) and compares an LSTM autoencoder against a transformer, finding the transformer is much faster and yields higher hit rates for top anomalies.
AI-written summary · about
chapters (17)
- 0:00Introduction and background
- 3:55Malicious logons detection with AI
- 5:20Defining lateral movement
- 8:51Power of graph analysis
- 11:01Graph tools for DFIR
- 13:52Userline tool overview
- 14:37Threat hunting vs incident response
- 15:42Machine learning for graphs
- 18:20Auto encoders explained
- 21:15Recurrent neural networks
- 23:05Introducing Chrysalis framework
- 25:33Case study with Conti ransomware
- 27:45Neo4j graph visualization demo
- 37:30Machine learning anomaly detection
- 41:26LSTM auto encoder results
- 44:23Transformer model performance
- 47:12Conclusion and resources
related talks
40mMe, My Adversary & AI: Investigating & Hunting with Machine Learning
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
27mChagu: Graph-Powered LLM Shielding and Anomaly Detection for Secure AI Pipelines
30mCybersecurity Risk Assessment Using LLM Agents and Graph Data Science
45mConnecting the dots to go from tabular security incident data to behavioral graph understanding
31mStreamlining Threat Hunting in Cloud Environments with Jupyter
19mThe Rise of AI in Anomaly Detection
36mA Graph-based Machine Learning early warning system to detect Ransomware