Detecting Website Intrusion and Account Compromise with Machine Learning
summary
Describes a deployed ML pipeline at Meta that detects pre- and post-login misuse using an isolation forest plus local outlier factor ensemble, real-time endpoints on FBLearner (SageMaker-like) and batch jobs, and 3–6 fused log sources. Claims cover testing with synthetic data and purple-team adversary emulation, retraining cadence tied to UC metrics, and results: anomalies are ~4% of traffic, critical ~0.1%, and the system meaningfully reduces escalations while enabling graded responses.
AI-written summary · about
chapters (17)
- 0:00ML for intrusion detection
- 1:03AI vs ML fundamentals
- 2:46ML algorithms for security
- 4:34Data sources & features
- 7:00ML in development lifecycle
- 9:25Feature types & text encoding
- 11:31Feature engineering for auth
- 18:36Model development planning
- 19:20Model architectures & ensembles
- 20:46Validating with synthetic data
- 21:50Adversary emulation for labels
- 23:35Batch vs real-time deployment
- 25:43Online deployment & response
- 28:11Model output & case studies
- 31:01Anomaly trends & response
- 31:47Modeling roadmap & tips
- 33:37Q&A
related talks
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges
10mML-based Log Analysis for Faster Debugging
28mMLGuard -- Detecting Malicious Web Requests using a Serverless-based Machine Learning System
43mHacking and Securing ML Systems and Environments
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack
16mLeveraging ML to Create a Reliable Anti-Fraud System