Deep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
summary
Converts per-host proxy logs into 60×1 images and trains a CNN on synthetic C2 patterns (no malware IOCs) to flag periodic beaconing; model detects all 11 live C2-communicating families in tests but requires whitelisting for frequent-refresh sites. Uses a 345-dim URL feature vector and a DNN to recognize Rig variants, and an LSTM on content-type sequences (length 5) to detect unknown exploit kits, spotting 14 EKs in evaluation; models aim for CPU deployment and are under ISP testing.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 2:30Existing Detection Methods
- 5:03C2 Savage Detection
- 5:35C2 Server Detection
- 8:48Combating Logs into Images
- 12:07Data Sets
- 16:41Models
- 23:46Summary
- 25:31Existing Methods
- 28:25Formal Method
- 32:40Content Type Transition
- 36:06Recurrent Neural Network Model
- 41:28Presentation Summary
- 42:26Questions
related talks
33mIDACUT: Inspecting DNS Anomalies Crossing Uncertain Times
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
44mApplied Machine Learning for Data Exfil and Other Fun Topics
30mData Driven Security
26mOptimized Invariant Representation of Network Traffic for Detecting Unseen...
27mAgentic Cyber Defense with External Threat Intelligence
37mAutomatic Extraction of Indicators of Compromise for Web App.