FIRSTCON21 - June 8 | Stream 3 Part 1 (12:00-13:00 UTC)
summary
Built a malware S4 similarity scoring system that integrates 17 tool scores, replaces hand‑tuned piecewise transforms with logistic regression, uses PCA to fix multicollinearity and over/under‑sampling to fix class imbalance, and reports ~76% correct rate comparable to a commercial service and clusters 19+ related samples reliably. Also documents Carrier Grade NAT risks: claims 95% mobile traffic behind CGN, shows attribution failures (49 innocents tied to one IP), default‑passworded CGN boxes, NAT table DDoS, and urges switching to IPv6.
AI-written summary · about
chapters (15)
- 0:00Welcome
- 1:57Speaker: Kuniko Yoshimura
- 3:24SOC missions and challenges
- 7:44ML in security operations
- 14:21ML trial and errors
- 22:53Evaluating ML effectiveness
- 26:05Conclusion: S4 tool future
- 29:14Next speaker: Simon Cannon
- 31:15Internet protocols and NAT basics
- 36:08Carrier-Grade NAT overview
- 40:01CGN deployment theory vs reality
- 44:11CGN security and privacy risks
- 50:40Real CGN issues examples
- 53:29IPv6 upgrade solution
- 54:11CGN risks during pandemic
related talks
24mCGN - Carrier Grade NAT - Carrier Grade Problems
14mClosing + CTF Wrap Up
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
44mNetsec is Dead(?): Modern Network Fingerprinting for...
47mDecisions and Revisions - The Ever Evolving Face of the Black Hat NOC
01h 12mRegular Session II
34mTop 5 for June
29mAttacking the Brain: Races in the SDN Control Plane