Cyber Security and Data Science
- 1. Cyber Security + Data Science NYU Data Science and Analytics Club Brennan Lodge September 26, 2018
- 2. Agenda • The Target Breach • Cyber Security is hard • A Cyber Security Analyst and the Security Operations Center • A Data Science Lens to Cyber Security • Visualizations and Reporting • A data science model for cyber security • NYU Data Science and Analytics Club plans
- 5. + Ransomeware + Spear Phishing + Crypto + Geopolitical
- 6. Cyber Security is hard
- 12. Logs, Events, Cases and Operations • Event Workflow • Many, many, many events • Correlation • High, Medium, Low? • Case Workflow • Investigation • Escalate • Review SEIM
- 14. Problem Statement • Problem Statement • Many Detections but a lot of noise • How? • Understand the detection rule inventory to identify fidelity in the rule set to reveal noise • Solution • By using data science methods, we can empower analysts to work on higher fidelity alerts
- 15. The balance of analysts and defense Defense & Detections Data Scientist Hackers Cyber Security Analysts Insiders
- 16. Data Science Project workflow Business Understanding & Requirements Gathering Data Discovery, Data Understanding and Use Case Development Data Preparation, Transformation and prototyping Analytics Delivery Measurements and Evaluation Actionable data-driven insights Data
- 17. • Get feedback on analytics to be implemented as reports for the SOC • Held a SEIM application and a data session with Sentinel development team Data Business Understanding & Requirements Gathering Data Discovery, Data Understanding and Use Case Development Data Preparation, Transformation and prototyping Analytics Delivery Measurements and Evaluation Actionable data-driven insights • Met with SOC Leadership to identify analytics opportunities • Operational Analytics • Case Detection Correlation • Identified SEIM Data in the Data Lake and reviewed data dictionary with SEIM dev team • Leveraged Juptyer Notebook and SQL queries to pull Sentinel Data and transform data into analytics• Delivered analytics prototypes to support the use cases and present findings to SOC leadership • Analytics provided to SOC to measure, track, monitor and make better data driven decisions
- 18. Operational Metrics qRun Rate ? q The operations q Shift for analyst = 8 hours q Number of Cases Created Per Day q Sustainable Production = # cases per hour q Current Production = Number of cases per hour / # of analysts q Difference = + or –
- 19. Rule Detection Analytics 0% 5% 10% 15% 20% 25% 30% 35% 40% 0 20 40 60 80 100 120 140 160 Detection Rules Fired vs Threat Rate Threat Rate More events fired per detection rule… …the higher threat detection rate
- 20. Model
- 21. SIEM Data Data Source Transformation Services End Services Table Merges SQL Queries Python Scripts Data Ingestion Python pickle file Modeling Dashbaord Reporting
- 22. Intrusion Detection Log workflow
- 23. Detecting malware from an Email
- 24. Logistic Regression to evaluate detections Examples of features and the dependent variable for scoring detections: Independent variables • Sensors • Detection Rules • Day of the week an event has made a detection • Is the event correlated with another event • Priority / Severity of the event as scored by a sensor Dependent Variables • Threat or Non-Threat based off of an analysts decision of closing an investigation
- 25. Visualize
- 26. Python - Plot.ly Dash
- 27. R – Shiny
- 28. Splunk
- 29. Splunk
- 30. Questions ??
- 31. NYU Data Science and Analytics Club
- 32. Appendix