hi this talk will be about
what machine learning can and can't do
for security
so my name is my name is wendy edwards
let me start by introducing myself i'm
from urbana illinois which is about 200
kilometers south of chicago
it is probably most famous as the
birthplace of hail 9000 in 2001.
so i work in my day job as a software
developer i'm part of the nasa data
knots which is what gave me an interest
in data science and machine learning and
i also got to participate in the 2017
um sans women's academy and on twitter
i'm wayward 710 and my pronouns are she
and her
so what are we going to talk about let's
start with terminology and concepts and
we'll have some
examples and we'll also talk about the
limitations of machine learning
so first probably a lot of you've
already heard of artificial intelligence
machine learning
and deep learning and they kind of and
they're essential
essentially kind of nested within each
other um ai is the broadest category and
machine learning and then deporting
so basically artificial intelligence
um if you recall since i'm from urbana
which is the birthplace
of um hail 9000's here is a picture of
hell 9000 um
and artificial intelligence which would
include hail would be the
branch of computer science uh that
basically attempts to emulate human
intelligence
and slightly more narrowly defined we
get machine learning
so machine learning machine learning is
really actually a lot of math
um so you and you can have um and it
looks for patterns and inferences
and um you can have something called
soup you've got things called supervised
and unsupervised learning those are the
uh
main categories and so supervised
learning um probably anybody in stats
may have heard about uh prior
probability called uh bayesian asian
modeling and that
is heavily used by um by uh supervised
learning
and with with unsupervised learning
you're basically drawing
abstractions from unlabeled data sets so
for example with the
supervised learning you tend to have
label data sets which means you have the
answers
um unsupervised learning you don't have
the data sets
you don't have the answers the data sets
are not necessarily labeled
and you could draw so you can draw
abstractions through these uh unlabeled
data sets
um so of course uh one challenge with
with unsupervised learning could be uh
making sure that you have it right
and then we'll talk about um
so uh we'll talk about deep learning
which also use the concept of
neural networking so neural networks are
actually not a new thing they were
invented in 1942.
so they're basically uh modeled on the
whole idea
of layers of neurons so they're modeled
after the human brain
so the layers are made out of nodes and
so the nodes is basically just where
computation happens
which is kind of how a neuron works and
essentially it fires where it can
encounter sufficient stimuli
um so the node combines um input from
data with a set of coefficients or
weights that either amplify or gambling
input so it's like um
do you want more of this input or less
of that input
in the l so the algorithm by going
through this process is trying to learn
uh what will get the uh kind of
how what will bring you the closest to
the right answer
and here we have a picture of a neural
network so you've got
in this case we have it's it is it's
what's called a
forward neural network um so you have it
in
you have a input layer then in this case
you have one hidden layer with four
neurons but you can have
more or less neurons or uh more or less
hidden
um hidden layers and you have an output
layer so that is essentially just what
they're talking about and now we're
gonna look
at some um videos of
some videos showing neural networks
let's see
so you can kind of see i don't think the
animation works you can kind of see
it's gradually getting it's actually
it's gradually getting better and better
so as you would because you're talking
about the test loss and training loss
and you want those losses to be as small
as possible but you kind of see
it's it's actually just trying to add um
accurately categorize the dots in the
picture you can see it's getting closer
and closer this is
basically the tensorflow program which
like anybody can use
it's just a very interesting way to see
neural networks in an action
see
so uh so um when you talk about neural
networks here i'm gonna talk about uh
tweaking parameters and that means you
might
adjust your you may adjust your inputs
you might adjust your layers to have
more or less
and so here let's see what happens if we
tweak it by just adjusting the input a
little bit
so by doing that we actually added we uh
we we
see with only one hidden layer four
neural networks we added more
we added more um features which is which
are more inputs
and if you watched it with closely you
can see it was very accurate but
it uh worked a lot more quickly than the
previous one
and that could be that could be actually
very significant like when you have big
data
and then this in here we're actually
going to look um at
just a slightly different kind of
pattern
and then actually that if i recall
correctly moves works a lot more quickly
if you have fewer input layers
but that is just a neural network um in
action and you can kind of see for the
weights of the line
which in which inputs are weighted
higher or which inputs are way or more
so essentially deep learning when you
talk about it's they
it could also be called stacks neural
networks so we've got a network composed
of several layers um
big data is a very big challenge one
thing that's helped with uh
with neural networks is advancements in
gpu processing um
gpu processing is a graphical processing
unit and that's you that's often used in
um basically big computing
so it's not a silver bullet because so
it needs an extensively labeled data set
and
and that is a lot easier to say than do
and then um but if but if you can get
that if you could get such a thing
there are a whole lot of things you can
do with it you can use computer vision
speech recognition natural language
processing
uh machine translation i don't know if
you've ever used like google translate
or
dbell.com but those are machine learning
and and it is for security
it's also uh can also detect anomalies
in user and network elements and that's
good and that's going to be very
important
so basically when you use machine
learning um what do you do with the data
so with data selection and sampling
you're deciding okay so
you've got a data set like let's say
you've got a pcap file you've got
something
um so what part what information in this
thing do you
do you care about uh what do you want to
represent
and that's often considered that's often
called your feature set
and um another the most machine learning
algorithms you're going to need to
encode the data in some kind of
mathematical faction a
mathematical fashion like just dumping
the raw data
usually is not going to work
and then uh then there's um
normalization like you're
um so normalization essentially you're
transforming values into a range
um in between zero and one
and those and this is just some things
you do to get your data ready for
machine
to plug into a machine learning
algorithm and then this would be an
example of normalization like you're
looking at the number of requests per
serve
per second in your cpu utilization
percentage
and that and that could be that could
tell you like if you're being hammered
by a ddos
attack um is is a bitcoin miner
embracing your gracing you on your
server with this presence
is something wrong going on so for
so in here the requests per second uh
feature have arranged 10 times larger
than those of the cpu percentage feature
and so if we didn't normalize those
values the distance
calculation would be really skewed and
so we just address it we basically
address this by normalizing both
features to the uh
zero to one frame zero to one rank which
is a pretty simple map
so essentially one big thing in machine
learning is pattern recognition so
you're trying to discover
explicit or latent character acidic tape
hidden in the data um and uh
i think about that is one thing about
that is that you can use an algorithm to
recognize
other forms of the data uh the ex it's
the same characteristics like for
example um
uh botnets or command and control
channels uh you very often see similar
behavior
um you also see like similar patterns
saying malware
so essentially um clustering um
clustering the whole idea behind
clustering is that bad things happen
together
so so with cl so with clustering you may
be you want to
find how do you group things into
clusters
and you want to group things in a
cluster so that they're more similar to
other things in the uh
to things the same cluster than they are
to other things
and there are a couple there are
different techniques you could use um
k-means and db scan are two big ones um
db scan
the advantage of db scan is that you
don't have to start with a
preset number of clusters
so let's talk about a clustering example
this is good i just put the the url i'll
post the slides
uh this is where they're uh
they're clustering they're clustering
incidents to incidents together they
actually
i believe incorporated splunk um so you
could
you could recognize similar instances
and keep track of response
people tracking responses they could
respond in a similar manner
so let's have your stock you're going to
have um a lot of these disparate input
inputs coming from different sources
um so that so you'll get all your
sources you'll collect
and then this will allow them to uh this
will basically group them into incidents
so an incident is basically a collection
of events happening on the same machine
at the same time they may have the same
root cause and so so basically you can
find these similar incidents maybe not
on the same machine maybe across your
network
that could save the soc analyst a whole
lot of time because the
um soc analysts sometimes often get to
spend their time
doing a lot of very tedious stuff
so clustering uh takeaways you can ex
you can apply it to a lot of different
kinds of data
um you do need to you need some
statistical
uh validation and um it's very useful
in when you have a whole art a lot of
data and you that you need to find a way
to
sift through more efficiently so that is
clustering
say classification
so classification is a little bit
differently because classifications
you've got these predefined class
and you're trying to figure out what
what the odds are that a sample will be
part of these
part of this class classified
classification is an example of
supervised learning which means you have
to start with a pre-labeled
set uh data set and what that one point
is that a sample can belong to multiple
classes at the same time
like for example um a mango could be
part of yellow tropical whatever
and it's like so so for example
an example of classification one really
big very common classification problem
related security is uh classifying email
is uh spam
or uh benign or possibly phishing
sometimes fishing gets its own
classification
so let's talk just some examples that
you might do classification
and security you might look for a botnet
because there's just a lot of
commonalities with that
um and then this is this is uh what this
is basically
what a microsoft study did they they
basically uh
so they they took uh they issued a bunch
of set http requests to these uh servers
they were looking for a very specific
set of uh bot software
to be honest it wasn't catching any kind
of bot it was sketching a kind with a
very
uh common bot related control panel that
used wordpress
and so they were querying it and they
then they were using it and they were
creating a uh decision they were using a
decision free model
um like like so for example like they
were
sending sending requests to path the
paths that were
kind of consistent with known um sketchy
sites
and then this for example might be what
a decision tree could look like if
you're trying to
categorize a an unknown a website
as a botnet command and control
site whether whether um not
like you could say do you have a whole
lot of daily visitors if you
if yes it's probably not yeah has it
made your
alexa top site list if yes probably not
um well but maybe it's it's not getting
many uh
visitors and your urls auto-generated
uh that's a bad um it's not on your list
and there's an existing threat intel
report on it
uh that's not good either that's
probably a bot or there's probably a
block notch
just classification taking ways um so
classic agent again is a super uh
supervised learning model there's a
four phases of that training validation
testing and deployment
so a lot of times with a classification
classification you you have to break
your data
into uh training and testing data
and one thing with with uh classifiers
is that it's it's not necessarily an
absolute oracle it's
it's not telling you that it definitely
is or it's definitely not it's telling
you what how likely it is that something
belongs to a particular category
like so for example um like in your
email um
you know how like that uh benign email
some students get
caught in your spam filter and spam
sometimes get through
uh that's an example of it not being uh
for not being perfect
so another example like finding finding
um malicious powershell scripts so one
of the things that
people powershells the attackers using
hardship like to do
is um obfuscate their scripts like for
example any idea what this means
uh yeah me neither
so what they so what they did was they
took a whole a whole lot of uh
powershell scripts and they used
something called and this is
this is a very interesting example of
machine learning uses natural language
processing
so there's all these techniques and llp
it can extract meaning out of uh they
could
attempt to extract meaning um out of
words and so they used what a well-known
one called a
word to back algorithm they were able to
actually extract these tokens
and represent them in a way that showed
the context
and this is just the graphic is just an
example of some clusters they found
doing this way
so they they uh see so what they
basically did was they
they had a very large um
set of uh trading scripts that were
already labeled uh
clean or malicious um and
and basically project workforce well it
it did
really well with uh recognizing aliases
which are pretty commonly used
um powershell
um and uh
so and uh it yeah yeah it was pretty
successful
so another thing you're doing is anomaly
detection um
so essentially you've got to think about
what what represents normal
so what it what is normal what described
your in your data set could be anything
it could be like your network
your network logs uh your your logs uh
your network flow whatever
and then if something is happening
that's outside normal that's considered
outliers
um and so a lot of times um unusual is
not necessarily bad but it often is
it's like so it often might suggest uh
fraud or something like that
so you have an intrusion detection
system or also like an ids
uh what do you want you want uh low
false positives and false negatives like
a false positive will
waste your stock analyst time a false
negative
you'll miss a threat um you want a
reasonable learning curve
um you want something that could keep up
because security changes constantly
and you probably will have only a
limited amount of resources and then
um explainable alerts like for example
um if you get an alert
um you don't you don't want to like
disable somebody's account without
knowing why
and then this is and then these are just
some um things you would look for in a
host
host intrusion detecting system your
processes
um do you have a sketchy new user
account
um do you have an unusual kernel modules
loaded
are you um looking up uh i don't know
are you looking up sites that are
known bad doing dns look up to on sites
that are problem
unusual network connection or have there
been unexplained changes made to your
registry
let's just look for that kind of thing
there's a fairly there's a pretty useful
tool tool for
most intrusive data inspection called os
query
um so i mean it can
it can measure reliability in appliance
but it's often used for intrusion
detection
um so for example um
for example like you can schedule it you
can populate queries to be
cables to be queried later um
one limitation is it is not built to
operate a known trusted environment
and it does not have any built-in
orchestration but it can work with sure
ansible public whatever that so network
intrusion detection
um okay so you've got to compromise post
it's probably going to need to um
initiate com uh communication somehow
because a lot of times like a firewall
is not going to let you
go in and make a uh and establish a
connection with that host
so so examples some examples that are
like your botnets
uh ept your adware your spyware you've
got and we're tools you use uh tcp
basically will capture all your network
traffic um
snort is a rules-based engine um
zeke which is all formerly known as
royal supports uh deep
deep packet inspection that's fact that
i got its own programming language it's
traditionally it's used uh it's used
signatures but that can be kind of a
limitation
um for example like when you're doing a
dealing with a zero day or something
ahead that
does not have a signature
and this and then these would be some of
the things you would look for
in web application intrusion detection
um
your basically unusual ip
addresses like um you've got you've got
maybe like a
website that's just local and you're
suddenly getting like a lot of traffic
from china and russia or iran
why um basically if you're getting
really strange url um
entities they maybe try they may be
trying to uh
they may be trying to fuzz it um if
they're using strange characters they
may be
looking for vulnerabilities uh or
other things could suggest sql and sql
injection um
user agent patterns like it like for
example
if you do if you're doing automated
access if you're using curl or something
you don't sell your user writing agent
it'll
it won't show one um
then malware analysis that's kind of
group like that's
basically group by family and you've got
a couple of ways you can
analyze your static it's traditionally
been
identified by signature matching but
that won't catch your zero days um
typically a static analysis is when you
look at code maybe you decompile it
your dynamic analysis is when you run it
in a sandbox
and then these would just be some of the
things you would see in android mail
where
your string strings uh
api calls network
um like for example you might see
references to system binaries server
addresses
um checks to see if you're running an
emulated environment like you've got
malware
maybe they want to know if you're
running it into sand docks and again
like we talked about a previous
example obfuscation
and i've got to show my gen xiness i
don't know if anybody recognizes this
guy but this is
bob seaver and the silver bullet band so
basically it's no slope of a bullet
as you talked about before we've
explained ability like um do you always
do you know why it is or why it's giving
an alert
uh there's a whole lot of human
knowledge
to represent others problems called
overfitting underfitting
um underfitting is like when it doesn't
fit your data very your data very well
period um overfitting is like for
example when it matches your training
data too well but not your real world
data
um garbage in garbage out which means
you start with bad data or
um or if your ai system is being
attacked which it can be uh like
sometimes
directing a bunch of crap and machine
learning system as a kind of z
form of attack
so basically your takeaway you've got
the potential to automate some tasks and
if it
increase efficiency um
so the ability to look for anomaly
detection or stuff that's going on
strange is very useful for
zero days or apds or stuff that does not
have signatures established
um uh risk of error um
like i mean one example like one example
i feel like we all saw was uh facebook
tried to automate some of its content
management you saw it doing
and i think a lot of us saw it doing
some really strange things
so this is so there's always a risk of
error
and we'll we will i think we'll always
need
competent security professionals this
isn't going to replace us
and then these are just some examples of
machine learning software you could use
and i'm going to give some credits to my
sources
and list some additional resources and
thank you so much for your time