Win the 0-Day Racing Game Against Botnet in Public Cloud
summary
Alibaba Cloud collects network and endpoint logs across >1M customers and uses an automated pipeline that correlates HTTP records with process/file alarms to extract attack payloads. It uses 2-gram payload matching to align repeated substrings between requests and terminal logs, data-flow tracking to follow injected data to system execution, and frequency-item set correlation to spot encoded or polymorphic exploits. The system blocks at scale (about 6 billion attacks/day), captured Citrix/F5 zero-days and caught a Jenkins RCE 20 days before botnets went wide.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:25Agenda
- 2:23ZeroDay Racing Game
- 3:43ZeroDay Monitoring Pipeline
- 4:41ZeroDay Monitoring Problem 1
- 6:01ZeroDay Monitoring Process
- 6:49ZeroDay Example
- 7:38Ingram Payload Matching
- 8:31Command Ejection
- 10:07File Upload
- 11:15Directory Traversal
- 11:51Real Fortnite Defense Story
- 13:05Timeline of Impulse Miner
- 14:21Defense Rules
- 14:46Example
- 17:01RCE Zero Day
- 18:08Monitoring Method
- 19:43Common digitalization vulnerabilities
- 21:44Summary
related talks
50mThe Anatomy of Cloud Attacks
56mUnify cloud security from code to runtime with CrowdStrike and Bionic
47mDetecting and analyzing files-less malware
43mThe challenge of AI in cloud security
50mInsights into New Supply Chain and Cloud-Identity Attacks
31mSecuring hybrid cloud environments
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
18mSecuring cloud innovation: Lessons learned