Me, My Adversary & AI: Investigating & Hunting with Machine Learning
summary
Project uses real production data (100 servers, 30 days, ~220k scheduled-task events and ~24M file-timeline rows), harmonizes diverse tool outputs with a HAM harmonization layer and runs D4ML pipelines on the DAISY VM; attacks are injected with the ADAM adversary emulator. A standard autoencoder only catches SolarWinds after pivoting event-log top 25% -> file list (malicious file ranks ~91 of 100), while an LSTM autoencoder on 30 days of 200k events ranks the malicious task creation as the top 1–2 anomalies. All code and VMs are open source.
AI-written summary · about
chapters (13)
- 0:00Introduction to AI in DFIR
- 1:33Tooling and methodologies
- 3:15Understanding anomaly detection
- 5:11The proposed methodology
- 7:18Threat hunting fundamentals
- 10:45Data collection and processing
- 12:22The role of autoencoders
- 15:46Advanced models and workflow
- 19:40Demo preparation
- 22:34Autoencoder demo (Phase 1)
- 27:31Pivoting demo (Phase 2)
- 31:57LSTM demo (Phase 3)
- 34:32Conclusion and resources
related talks
48mHunting Stealth Adversaries with Graphs & AI
53mAI-equipped Threat Actors Versus AI-enhanced Cyber Tools: Who Wins?
43mThe challenge of AI in cloud security
01h 01mExploiting the supply chain
25mBeyond Human Scale: AI and Automation as Force Multipliers in Cyber Threat Intelligence
42mAI Math Models Help Hunting Cybersecurity Threads
36mBeing A Better Defender By Channeling Your Worst Adversary:
57mAI as the New Hacker Frontier