Threat hunting at scale with decision trees, regressions, and clustering

No ratings

Presented at BSidesDenver 2017 by

Matt Berninger

Threat hunting at scale is a scientific data reduction problem. However, in practice it is often treated more as an art than a science. While creativity and innovation are key to any successful analysis team, scalability requires common processes and techniques for analysis. Using common data sources such as netflow, event logs, file listings, and others, this presentation will show how to apply several data analysis algorithms to find anomalies in a repeatable, scalable, and sensible manner. These algorithms can also illuminate new analytical methods and spur innovation. In this way, hunting operations can scale to analyze more data, more often, and provide higher confidence results.