Exposing Attacks Hiding in the Sheer Noise of False Positives
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.
Summary
The Alert Fatigue Challenge in SOCs
Modern security operations centers (SOCs) are overwhelmed by millions of daily security logs, alerts, and false positives, obscuring subtle indicators of sophisticated intrusions.
Clustering Heterogeneous Security Data
Leveraging open-source data science models and machine learning pipelines enables automated grouping of disparate log events based on behavioral similarities.
Reconstructing Attack Kill Chains
Encoding security domain knowledge into clustering algorithms transforms noisy telemetry into correlated multi-stage attack narratives and actionable intelligence.
Enhancing Security Operations Efficiency
Deploying automated alert clustering significantly reduces analyst fatigue and accelerates incident triage without requiring dedicated data science expertise.
Related talks
Creator Stage·43 min
Josh Pyorre
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.
Creator Stage·26 min
Brandon Bailey
Applies offensive techniques from the SPARTA framework to generate behavioral indicators (IoBs) and design realistic intrusion detection systems for spacecraft.
Creator Stage·25 min
Adel Karimi
Presents Galah, an LLM-powered web honeypot that dynamically generates authentic HTTP responses to emulate diverse web applications.