Applied Machine Learning for Data Exfil and Other Fun Topics
summary
Nmap output becomes feature vectors (ports, service banners, script text) and is clustered with K‑means and interactive splitting so a user drills from hundreds of IPs to meaningful groups; a botnet panel detector issues 39 HTTP probes, fingerprints responses with SSDEEP fuzzy hashes and classifies 13 panel types via an ensemble of decision trees exposed as a Chrome extension; a Markov-chain text obfuscation encodes a private key by choosing the nth‑most‑likely word transitions trained on Project Gutenberg or Taylor Swift lyrics; code is on github.com/stencespear
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:02Welcome
- 1:58Goals
- 2:25About Silence
- 2:50Tools
- 3:13Machine Learning
- 4:12Feature Extraction
- 5:05Scikitlearn
- 6:53Features
- 8:04Vectors
- 15:01Demo
- 15:30Automatic Method
- 26:05Decision Trees
- 30:58Botnet Panel Classification
related talks
48mCatch me if you can: Building a Web Malware Analyzer using Machine Learning
50mDeep Impact: Recognizing Unknown Malicious Activities from Zero Knowledge
44mUnmasking APTs: An Automated Approach for Real-World Threat Attribution
59mCatching Malware En Masse: DNS and IP Style
47m Natural Language Processing & Anomaly detection in Sys call logs
21mMachine Learning and Cyber Security - Detecting malicious URLs in the haystack
30mData Driven Security
29mscikit-learn, machine learning and cybercrime attribution