Secure Because Math: A Deep-Dive on Machine Learning-Based Monitoring
summary
Marketing promises "because math" while research still leans on old benchmarks like KDD99 (6,300+ citations) and lab claims such as ~95% detection that collapse on real traffic; high-dimensional problems (a 1,000‑node network yields half a trillion dimensions) break naive anomaly detectors. The team builds a semi‑supervised system seeded with threat feeds and structural signals — passive DNS / DNSDB / ASN features — that processes firewall/proxy/IDS logs and returns a triage list of ~10–20 hosts for analysts; beta shows iterative improvement but faces normality‑poisoning and false‑positive limits.
AI-written summary · about
chapters (26)
- 0:00Intro
- 0:45whoami
- 3:44Security Singularity Approaches
- 6:38Guess the Year!
- 8:00A little history
- 9:12Three Letter Acronyms - KDD
- 13:08Trolling, maybe?
- 13:22Not here to bash academia
- 14:16A Probable Outcome
- 16:17ML Marketing Patterns
- 17:44Anomaly Detection
- 21:28AD: Curse of Dimensionality
- 23:54A practical example
- 24:21A MORE practical example
- 25:38Breaking the Curse
- 28:32AD: Normality-poisoning attacks
- 31:06AD: Hanlon's Razor
- 32:30What about User Behavior?
- 35:47Classification!
- 36:52Lots of Malware Activity
- 39:26Everyone makes mistakes!
- 43:26What about the Ground Truth?
- 44:50But what about data tampering?
- 46:06And what about false positives?
- 47:46Buyer's Guide
- 49:57MLSec Project
related talks
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
10mQuick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
30mData Driven Security
42mAI Math Models Help Hunting Cybersecurity Threads
27mCollect All the Data; Protect All the Things
22mMachine Learning Based Attack Vector Modeling for CyberSecurity
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware