Connecting the dots to go from tabular security incident data to behavioral graph understanding
summary
Converts network logs into explicit connection graphs and shows this makes multi-hop reconnaissance and exfiltration obvious: a public NetFlow set becomes 400k nodes 500k edges, an exfiltration subgraph contains only two IPs with the attacker using many ports against a single victim and keys hit on port 4848 and 445. Pipeline uses Pandas/Polars + NetworkX or QGraph / cuGraph on GPUs with Cytoscape.js, Gephi and Graphistry visualizers, MITRE ATT&CK edge tags, animated timelines, UMAP clustering, and achieves sub-second traversal at millions of edges.
AI-written summary · about
chapters (14)
- 0:00Speakers and Graphistry
- 2:14Graphs in cybersecurity
- 5:42GPUs for graph processing
- 11:20Cybersecurity dataset to graph
- 13:50Exfiltration with small graphs
- 19:52Medium graph investigation
- 24:52Attack progression visualization
- 28:42Large graph with Gephi
- 31:54GPU vs CPU rendering
- 34:26Graph applications beyond security
- 38:22Graph analysis tools
- 40:10UMAP clustering and anomalies
- 42:36Free Graphistry options
- 43:38AI agents for graph analysis
related talks
20mAttack of the Graph: Visual Tools for Cyber Analysis
40mHow to Map Networked Devices Using Graph-Based AI to Preempt Cyber Threats
48mHunting Stealth Adversaries with Graphs & AI
49mRelational Observability for Cloud-Native Security and Data Science
28mGraphs + Sensors = The Internet of Connected Things
26mBreaking the Attack Graph: How to Leverage Graphs to Strengthen Security in a Domain Environment
30mContext Engineering: Connecting the Dots with Graphs
31mSix Degrees of Infiltration