Behavioral Security: 10 steps forward 5 steps backward

No ratings

Presented at DeepSec 2011 by

Rule-based behavioral security has been talked about for decades BUT is it really the silver bullet solution to the malware problem? We dont think so. In this talk, well discuss the pros and cons of rule-based behavioral systems, using real-world threats as case studies to showcase the approachs strengths and weaknesses. Next we will discuss how techniques such as supervised and unsupervised machine learning can address many of the inherent limitations in legacy behavioral systems. We will demonstrate how to implement such a machine learning-based behavioral system using freely available tools like WEKA, and provide the attendee with sufficient information to further investigate this area on their own. Finally, we will discuss their limitations of these machine learning-based solutions and propose several potentially fruitful areas of research. The talk will use real world threat examples to illustrate points. Here is the outline of the talk: Motivation behind behavioral security Malware space data analytics Rule-based Behavioral Security Overview Explanation of rule-based behavior blocking Pros and cons of the rule-based model Malware case studies New cutting edge approaches Machine Learning: Supervised & Unsupervised How to build a machine learning-based behavioral system Practical Application, Limitations and Challenges Challenges of real-world deployment Requirements of real-world behavioral solutions Real-world case study review All the things that can and will go wrong Final review of the solution Strengths and weaknesses