Learning Detection Indicators from Cyber Threat Intelligence and Their Applications
summary
Describes a machine-learning approach that ingests daily-shared cyber threat intelligence (CTI) — specifically indicators like IPs and domains that attackers rapidly change — to train a detection-indicator learning engine that models how attackers use those indicators. Reports implementation results of the learning engine and explores combining reconstructed learned indicators with other data sources to enable medium- to long-term proactive defenses.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:23CTI overview and challenges
- 9:04Motivation for detection indicators
- 10:08Detection indicators and applications
- 16:00Real-time processing systems
- 21:45Spam botnet case study
- 26:46Predicting attacker trends
- 31:25Indicator learning challenges
- 35:01Data processing methods
- 38:34Summary and future
related talks
27m"Cybertelligence": How AI is changing the face of cybersecurity
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
20mDynamic Defense: Crafting threat models with real-world Intelligence
10mQuick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
32mTen Years of Cyber Threat Intelligence: Retrospectives
43mCyber Threat Intelligence (Experts recommendations to enhance your security posture)
16mIntelligent by design: Can cybersecurity cope with AI?
21mAdvanced Cyber Threat Intelligence Chapter - How to Read the Mind of your Attackers