The Security Wolf of Wall Street
summary
OpenDNS describes a live pipeline that turns ~80B DNS queries/day into real-time blocks by running a Python + ZeroMQ Avalanche stream framework across EC2 instances (master/slave, 30k msg/s per cluster) that drops old chunks to favor freshness. A text-mining plugin NLP-Rank classifier extracts forms, TF‑IDF → LSI vectors and uses cosine similarity (examples hit 99%+) to detect phishing, then graph-based breadth‑first mining pivots on emails/IPs and feeds blocklists — deployed, benchmarked, and operating in production.
AI-written summary · about
chapters (8)
- 0:00Start
- 5:08WHAT IS AVALANCHE? OVERVIEW AND TECHNICAL DETAILS Open source project
- 6:06AVALANCHE PIPELINE
- 6:43AVALANCHE DESIGN
- 7:18AVALANCHE NODE PLUGIN TEMPLATE CODE
- 10:36PIPELINE (Simplified)
- 15:07DATA MODELING EXAMPLE
- 23:49BUILDING INTUITIONS
related talks
58mThe Security Wolf of Wall Street: Fighting Crime With High-Frequency Classification and...
59mCatching Malware En Masse: DNS and IP Style
49mA Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
29mThe Ever-Changing Labyrinth: A Large-Scale Analysis of Wildcard DNS Powered...
50mTowards a Holistic Approach in Building Intelligence to Fight Crimeware
25mDark Side of the DNS Force
47mDNS On Fire
43mWho are the people in your neighborhood? Tracking 'Shady' CIDR blocks