Post on 11-Apr-2017
Powerball Predictor
Photo Credit: Sean McGrath
Crystal ball tells me with 99% accuracy if a powerball prediction is a winner.
Powerball Predictor
Photo Credit: Sean McGrath
● ~300 million samples.● ~ 3 million false positives.● 1 true positive.
Powerball Predictor
Photo Credit: Sean McGrath
The overwhelming majority of tickets are not winners.
Failing to recognize this is falling victim to the base rate fallacy.
Security Crystal Ball
Photo Credit: Sean McGrath
The overwhelming majority of log entries and data points do not represent fraud and intrusions.
Failing to recognize this is falling victim to the base rate fallacy.
FRAUD Intrusion
Detection
System
Source: MXLabs
Base Rate Fallacy
Why False Positives?
Case Study: Outlier Detection
Using an outlier detection system to identify fraudsters within the environment.
For a set of generating mechanisms find the unusual ones.
Example Time Series
Photo credit SuperCar-RoadTrip.fr under Creative Commons Attribution 2.0
Change in the data over time in unforeseen ways.
Concept Drift
Solution: Feedback Loop
Explicit Feedback Loop
Photo credit Alan Levine under Creative Commons Attribution 2.0
Explicit Feedback Loop
Photo credit Alan Levine under Creative Commons Attribution 2.0
Implicit Feedback Loop
Fraud: Takeaways
- Concept Drift is a shift in behavior.- Feedback combats concept drift.- Implicit Feedback > Explicit Feedback
IDS: Anatomy of Successful Detection
Context: Security Analyst
Red team Kill Chain
Blue team Kill Chain
False positives: Lose Ability to Triage
Fact: You cannot salvage a false positive with Contextual Info or Visualization
What is a Successful detection?
Properties + Frameworks
Successful detection captures Adversary TTP from Sensor data ignoring Expected activity
Source: @MSwannMSFT
Properties of a Successful Detection
Adaptability
Credible
Interpretability
Actionable
Basic Advanced
Less Useful
More U
seful
Sophistication of Algorithms
Usefulness of A
lerts
Secu
rity
Dom
ain
Kno
wle
dge
Framework for a Successful detection
Basic Advanced
Less Useful
More U
seful
Sophistication of Algorithms
Usefulness of A
lerts
Secu
rity
Dom
ain
Kno
wle
dge
Outlier
Basic Advanced
Less Useful
More U
seful
Sophistication of Algorithms
Usefulness of A
lerts
Secu
rity
Dom
ain
Kno
wle
dge
Outlier
Anomaly
Increase Complexity
Basic Advanced
Less Useful
More U
seful
Sophistication of Algorithms
Usefulness of A
lerts
Secu
rity
Dom
ain
Kno
wle
dge
Outlier
AnomalyIncrease Complexity
Security InterestingAlerts
Incr
e ase
Dom
ain
Kno
wle
dgeSuccessful
Detections incorporate Domain Knowledge Alerts
How to encode Domain Knowledge: Embrace Rules
• Business Heuristics to filter out the “Security interesting anomalies”
• Rules can take many forms: •TI feeds •IOCs, IOAs•TTPs
• Rules are awesome • Credible, Interpretable, Adaptable (to some
extent), Actionable!• Highest Precision • Highest Recall
Three ways to combine ML and Rules
Three Ways to combine Rules and ML 1.Above Machine Learning Systems
a.Business Heuristics to filter alerts i. “For account _foo_, only raise sev 2 alerts until March 28th, 2016”,
Work by Dan Mace et. al, Microsoft
2. Below Machine Learning Systemsa. Featurizations - “If IP address present in List of malicious IP dataset, flag 1”b. Utilizes Threat Intel feeds (Cymru, Virus total, FireEye)
3: Combining Rules and Machine Learning together using Markov Logic Networks
Initial Ideas given by Vinod Nair, MSR
Intuition
•Rules alone place a set of hard constraintson the set of possible worlds•Let’s make them soft constraints:When a world violates a formula,It becomes less probable, not impossible•Give each formula a weight(Higher weight ⇒ Stronger constraint)
Source: Lectures by Pedro Domingos
Interactive logons from service accounts causes attack
Similar service accounts tend to have similar logon behavior
Example: Service Accounts
Domain Knowledge
Example: Service Accounts
Encode as First Order Logic
Example: Service Accounts
1.5
1.1
Example: Service Accounts
AssociateEach Rule With the Learned Weight
Example: Service Accounts
1.5
1.1
Attack(A)
InteractiveLogon(A)
InteractiveLogon(B)
Attack(B)
Example: Service Accounts
Consider two service accounts: A,B
Example: Service Accounts
1.5
1.1
Attack(A)
InteractiveLogon(A)
InteractiveLogon(B)
Attack(B)Similar(A,
B)
Similar(B,A)
Similar(A,A)
Similar(B,B)
Example: Service Accounts
1.5
1.1
Attack(A)
InteractiveLogon(A)
InteractiveLogon(B)
Attack(B)Similar(A,
B)
Similar(B,A)
Similar(A,A)
Similar(B,B)
Example: Service Accounts
1.5
1.1
Attack(A)
InteractiveLogon(A)
InteractiveLogon(B)
Attack(B)Similar(A,
B)
Similar(B,A)
Similar(A,A)
Similar(B,B)
•How to learn the structure? •Begin with hand-coded rules•Use Inductive Logic Programming, but need to infer arbitrary clause
•How to learn the weights? •For generative learning, depend on pseudolikelihood
•Checkout Alchemy -- http://alchemy.cs.washington.edu/
Call for Action - After the conference • One Week
•Review •@CodyRioux - IPython Notebook•@Ram_ssk - Follow Up material
•Think comprehensively about Rules
• One Month •Ask your data scientists to literature review section
•Implement the rules on TOP of ML systems
• One quarter•Implement a feedback system to capture training data
•Implement all TI feeds within an ML System
•Play with Alchemy
Literature● The Base-Rate Fallacy and its Implications for the Difficulty of Intrusion Detection
(Alexsson, 1999)
● Enhancing Performance Prediction Robustness by Combining Analytical Modeling
and Machine Learning (Didona et al., 2015)
● Richardson, Matthew, and Pedro Domingos. "Markov logic networks."Machine
learning 62.1-2 (2006): 107-136.