Thresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
No ratings
Presented at BlackHat Europe 2022 by
SOCs aim at detecting threats. Credit Agricole's SOC collects more than 10TB of data, including logs and PCAPs on a daily basis.Legacy detection systems are shaped by static rules and thresholds which cannot extract the added value they could from the amount of collected data.While we could buy expensive security solutions coming with their own AI models, why not invest money in research and start working on how to enhance our detection capacity by ourselves? Especially if confidentiality is a concern, and if we don't want our data to be given to security vendors for free.Data science is not only about nice mathematics and gradient descent, data science is way larger and more complex. Since machine learning models are only as good as the data that they use and the chosen representation of it, why can't we, as security engineers, deep dive into artificial intelligence and machine learning so we can enhance our detection capacity by ourselves? Who better knows security datasets than the InfoSec practitioner that has been working on it for many years?This talk aims to demystify AI and the most common machine learning techniques, trying not to reinvent the wheel but making sure we master the main concepts so we can extract needed value to be able to build the most efficient use cases only using data we are already collecting, machine learning basics and python. After describing the main AI concepts, we will provide a return on experience on how Credit Agricole's SOC Team tries to use its own made machine learning, focusing on how we used it to prevent data leakage and detail how we are leveraging our detection process with a live demo.