Keynote Q&A – Verónica Valeros
summary
Argues that machine learning is essential to sift terabytes of network data and describes a layered ML pipeline of tiny, fast anomaly detectors that emit scores and a combiner module that fuses verdicts — a system built for speed that “works pretty well” on post‑incident hunting. Inputs are mainly proxy logs and NetFlow, not just packet captures. Recommends the CTU-13 dataset to prototype, warns about label quality, false positives and scaling limits.
AI-written summary · about
chapters (11)
- 0:00Q&A session
- 1:09Verónica’s cybersecurity background
- 3:23Cybersecurity in real life
- 6:12Real-time threat detection challenges
- 8:54Detecting post-compromise threats
- 12:30CTU-13 dataset research
- 15:53Proxy logs vs net flow data
- 21:40Static malware analysis ML
- 25:59Stress in cybersecurity work
- 34:16Diversity in cybersecurity
- 39:45Security and user responsibility
related talks
32mAI/Machine Learning: What is Actually Working in Cybersecurity?
44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges- 44mAdvancing Cybersecurity with AI and Machine Learning: Opportunities and Challenges
10mQuick Look: A Real-World Example of Using Network Behaviour to Detect Cyber-Compromise
29mThresholds Are for Old Threats: Demystifying AI and Machine Learning to Enhance SOC Detection
48mHunting Stealth Adversaries with Graphs & AI
30mData Driven Security
12mKeynote: Leave it to the Machine - How to Leverage AI to Effectively Shift Left Sec...