AI Math Models Help Hunting Cybersecurity Threads
summary
Claim: models ingest a terabyte of logs a day (~200,000 entries/sec) and flag outliers by counting rare tokens and scoring entries, not by signatures. Tools actually used: vendor-specific dictionary models stored in a model library, clustering into message vectors, numeric baselines and a Pearson correlation matrix to narrow root cause candidates. The system runs on-prem (avoids cloud LLM GPU dependency) and exposes an AI explain assistant; demo shows anomaly scores, clusters and vendor-specific dictionary models driving alerts.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:55Company background
- 7:15Security needs local context
- 11:10Detecting anomalies in logs
- 18:45Analyzing numeric data
- 22:22Clustering logs
- 28:54Building knowledge graphs
- 33:11Narrowing root causes
- 36:40On-prem math vs cloud LLMs
- 38:27Q&A
related talks
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
25mMonitoring AI with AI
43mNavigating the AI Frontier: Investing in AI in the Evolving Cyber...
22mMachine Learning Based Attack Vector Modeling for CyberSecurity
52mAI in Cybersecurity & Fraud Prevention
11mAI-Powered Cybersecurity in the Age of Advanced Threats
27m"Cybertelligence": How AI is changing the face of cybersecurity