Building Robust Threat Detection Models with Scarce Attack Logs - Athul Raju

So yeah, needling the hashtag paradox building robust detection with scarce locks. It's a mouthful, isn't it? So this is a very data scienceheavy topic, right? So I'm not assuming that everybody who is sitting in front of me in a in a security conference is fully aware of data science and this concept. So this will be a very beginner friendly topic, right? So um start with who I am. My name is Satul Rajul. I work for Oracle cloud infrastructure. I lead their the detections team. Um yeah I do similar research. So if you are interested feel free to reach out. All right. So what exactly is the problem I'm trying to say here? So this is a typical data science problem. It's

called class imbalance. Right? Sometimes it's referred as extreme class imbalance. It changes. Now what exactly it is when you're trying to build a model a detection model or any model with a bare minimum like a very limited set of true positive locks then something like this can happen right that means the true positive locks or the actual attack locks is only when when it's only a fraction of the total volume this can happen right now some of you might be thinking right why are you trying to introduce a problem to me and then provide a solution to that. It's a very interesting question if you think about it like that right see when you think about thread detections

right the first thing that comes to your mind is sim right a query based detection in sim right they can solve a lot of problem right they can solve a lot of problems but as the attack vector gets sophisticated right we to have reached the point where we have to introduce data [snorts] science a IML and deep learning into the detection building capabilities Now this is a problem that is caused by that right now like I said let me explain to you like all of you how a typical model is built like I'm taking an example of something called a classifier models right so how a classifier model is generally built then introduce then I'll

introduce like how problem this problem can happen there and I'll propose two solutions right all right So let's talk about building a classifier. What are classifiers? Now classifiers are models that can give boolean outputs. 0 1 true false [snorts] buffer overflow not a buffer overflow instance principle stealing not an instance principle stealing. So it can we give you a boolean output. Now what are the essential factors you need to build a model like that obviously you need an algorithm right model algorithm it goes by different name let's not talk about algorithm for a second right because algorithms are no you don't need to create an algorithm yourself right if it's ML it's there you know you can use the Python libraries

scikitlearn has a lot of ML models algorithms now if it's deep learning you can use kas pytorch etc. Right? So, algorithms are there. What you need to do is train the algorithms, right? Train the models. Now, how are you going to train the model? It's pretty much like a baby, right? Like a like a child, right? You need to teach it something for it to find it in the in the in the future. So, think about it like that, right? For for you to train the model, you need data sets, locks, right? So you're basically teaching the model how a buffer overflow would look like right through logs right you are actually feeding it with the

real buffer overflow log or any security use case log and teaching it okay this is how a buffer overflow would look like right then what h what happens is you finish your training then test the model with unseen data right what are unseen data data which were not part of your training set that's how you measure the performance of a model, right? You're training the model and then following it with testing with an unseen data. Okay, that's whole pipeline basic in a high level overview of a pipeline. Let's take an example, right? Now, this is my use case. We want to build a model, right? All of you want to build a model. Now, this is

our objective. We need to build a model to recognize the presence of a lion in an image. Right? Very simple, right? You feed the model with an image and the model should tell you again boolean like true or false. The model should tell you whether that image contains a line or not. Pretty straightforward, right? Nothing complex about it. Now, how do you build such a model? Obviously, step one, choose an algorithm, right? Since it's an image, you'll have to use something a neural network, right? Now, what else you need? Data set. You need to train the algorithm, right? to train the model. So for that what you need obviously you need to train the model with real

pictures of lion right you you have to send uh train the model with real pictures of lion from a diverse set of environment right you cannot train the model with the same image of like like 100 lines like copy of same image and expect it to work for work for unseen data it does not work like that you need to have a diverse set of data diver of data means line from different angles is right. Lion under different lighting, lion from different ecosystem, right? Lion in a zoo, lion in a forest, lion in a house. Now once you feed this information to the model, it will obviously understand the features of a line, right? Obviously

whiskers, the hair, it will understand the features of the line. And later if you test it with an unseen data, it will be in a better situation to predict the presence of a line from an image. Right? Now model can make mistakes, right? Model do can make mistakes. We make mistakes. Remember this guy from last year. Even for split second we thought it's a line, right? I mean from that picture, from this picture that this can happen, right? Model can make mistakes. Now, so we have successfully bu successfully built a model, right? Now, let's build one more like one more model. Similar approach, nothing is going to change. Now, instead of lion, we are going to

find the presence of a different animal here, right? Whole different animal. We're going to build a model to find the presence of a unicorn. Have you seen unicorns? Now, we haven't seen unicorns, right? What's the problem here? Do we have enough data sets for images of a unicorn like we do have for the lion? No. Right? You don't have that's role. Now, without enough data set, how are you going to train the model? How are you going to train the model and teach it like these are the features of a unicorn? How are you going to do that? And this exactly is class imbalance, right? And we don't we don't have the data set to actually train the models.

Now think about it for a second. Is it an algorithm problem? This is not an algorithm problem because the same algorithm successfully classified lion. Is it a data set? Is it actually a skill set problem? The skill set gap within an engineer? No. The same engineer built the the line is unable to build something for a unicorn. So this is precisely a data set problem right one of the most common problem in cyber security these days. Now can we fake the data? Can we dress up a dongi like a unicorn and get some pictures and train the model? No no it doesn't work like that. Right? Obviously we can synthetically create some data you know

you can use AI you know to create some data but that might not be enough right? Like I said the data has to be diverse right? how much you can create with synthetic data. So there are limitations. So let's go back to security for a second. Now I'm going to say let's compare the unicorn use case with inside a thread. Now this we have a similar problem here. Insider thread obviously you know very common these days. It does not we don't really have enough insider thread locks within a company right. Obviously we should maybe have handful of locks. We can synthetically create some of the locks. But how is that different from Unicorn? Now that is

not different. They're basically the same for from a data science point of view. These are similar problems. They're not different. They're similar problems. Now so like I said that is classic balance. It's pretty much a data data set problem. Now why am I talking about a data science problem in uh in a cyber security conference right and why is this not a problem in field like aviation or medical sciences? Have [snorts] you thought about that for a second? The reason is in the field of aviation and medical sciences there are so much going on right there are awesome models out there. There are models in medical sciences that can successfully identify cancerous tumors from scan reports. Why

is it not a problem for medical sciences and why is this a problem for cyber security? Data set shared right in the field of medical sciences, aviations, etc. The data side data set is pretty much shared, right? If an air crash air crash happens, that information including the telemetry is shared with pretty much everyone in that domain. Even the air crash investigation report is released publicly. You know, anybody can read. Is is that the case for cyber security? It is right to some extent it is. But but for sensitive and complex use cases like you say inside a thread that's not the case, right? Nobody is going to share you the telemetry of our inside from

their company because obviously it is sensitive right which means we will have to deal with this problem right now that means sock will have direct implications threat detection team hunting team IR intelligence team they need to understand about this that's why this is a unique cyber security problem now let's talk talk about the solution um with a demo right so I have a demo now let's before I dive into the demo I need to just talk about a couple of things one is about the data set I'm using for the demo now specifically I'm talking about uh inside of it so I have used the car mill university inside of data data set uh it's a open source data

set anybody you can download it from their official website specifically I'm using the R5.2 into email locks. It's email locks, right? So what you can expect all the fields associated with an email, right? So that is sender, receiver VCC subject, attachment, all those information, timestamps, etc. It's a it's a basic email loss. Now before I move on to the demo, I just want to share one more thing, right? How is a good detection measured today? Squery based detection not talking about model based detection. A good detection today is measured basically based upon the number of true positive it creates. Right? If it generates far more true positives than false positives and positive, we generally say it's a good

detection. Right? Now that it's not that easy for a model, right? For for measuring the performance of a model, we have four different [clears throat] parameters. [snorts] Accuracy, precision, recall, and score. Now, I'm going to make a bold statement here. I'm going to say in the case of class imbalanced data accuracy is not a great measure. I'll prove to you why. Now precision and recall there there is formula out there. I mean taking a look at the formula if you're good enough. Yeah. Awesome. Right. But forget about the formula for a second. The recall is a detection engineering parameter. What is recall? It's basically how well your detection is performing to find proposes. That's it. Simply think about that like that.

Precision is a soft feature. Soft metric, right? More the more the precision, less the noise. Less the precision, more the noise. You think about like that. That's a soft feature. Soft metric. This is a detection engineering metric. Now, effort score is very very important. It basically is a combination of precision and recall. Now moving on let's talk about the baseline model. So what I have done here is I have made you three experiments. One is testing the carnage mill university locks which is heavily class imbalanced. I'll show you the locks and one first first what I'm trying to do is I'm running it against a baseline model without any fixes. After that I'll apply two techniques.

Are these the only two techniques out there for glass imbalance? No, there are so many other techniques, right? But these are probably easiest technique to follow. Sometimes the easiest techniques are more most of the time the effective techniques, right? In this case, they are. But the effectiveness of a technique changes from data set to data set. Right? All right. Let's go to the notebook. All right. So one thing I want to share here is like in in data science data prep-processing is so important. I'm not going to talk about add processing prep-processing for now. It's basically like I'm starting from step 100 right [snorts] there are 99 different steps which is all commended out here which which need

to be done. What am I doing? They are basically transforming my lock sources. Right? In this case the email from Kim I'm doing a lot of things here I'm doing normalization I'm doing transforming I am getting rid of outliers I am understanding the features of the columns or features the whole process is sometimes called as EDM exploratory data analysis obviously I build features myself here there is one reference to feature engineering which means I'm finding new features or columns right from existing columns Right? It can be a combination of multiple columns from the locks. Long story short, there are 99 different steps. I'm not going to share with you because of the time constraint. I'm

starting from step 100. Okay. This is our lock source. Uh now one one other thing I want to share here is since Kim log is like it is a simulated log. It's not a real lock. Okay. So they have actually done the labeling right. What is labeling? They basically have gone through line by line, log by log and label it zero or one. Zero means not an insider activity. One means an insider activity. So in in this case I have around like 400k non- insider activity and one and like basically less than 2,000 insider activity. You see the difference, right? The the true positives are basically less than 04%age of the total volume. Now this is a class

imbalance step. All right. Now one other thing I want to tell you here is like like I said remember I talked about unseen data right unseen data where you test them test the model with. So what I'm doing is from the entire data from the entire data I'm telling 7% that is 70%age will be used for training and.3 will be used for testing purposes. So I'll be training with the point 7% like 70 70%age of the logs and rest point 3 will be used for the u yeah testing purposes. All right the first first technique like I said the baseline technique without applying anything it's going to be I'm using logistic regression. You know this regression is a basic classifier

layer classifier what it does it is basically you know just boolean like boolean this it will say whether inside or not same same thing no no no different now I'm running the logistic regression and then this is my output accuracy 99.98% is precision 0 equ= 0 f1 z it has a very high accuracy right this is why I said Like sometimes accuracy can be a misleading information. Why does it have a really high accuracy and pretty much everything else zero? Remember the formula of accuracy from the previous di previous slide. The formula of accuracy is true positive plus true negative by total. So basically what's happening here is model is doing a great job in finding zeros

and a horrible job in finding ones. How did I know? because the recall is zero. So ba basically model is doing every bit of a skill to find zeros but it is not even finding a single insider activity. That's why I said accuracy is a very irrelevant metric when it comes to class. All right. Now let's apply the very

All right. Let's apply the first fix. Right. So all right soon now remember this guy from X-Men I I don't know if you remember his mutation is he can multiply himself right he's from one of X movie for all so he can multiply himself remember the first fix which is a data level fix it's called smoke or smoke uh what it does is it multiplies the minority right in our case the minority is ones the insiders Right? It's multiplies a minority from the unicorn analogy. It's not creating the copy of the same unicorn more or less like creating multiple copies of say unicorn cousins, right? Similar copies but not identical, right? How is it doing? It's

using something called a k nearest neighbor algorithm. Um yeah, what that's what it is doing right now. How how do you apply smooth So this is how you do it. So you're telling the algorithm that I need the minority to be 50% as much as the majority in this case zero. So it's an very aggressive number. I normally not start with 50% but for the sake of demo I'm giving an aggressive number. So what does that mean is my once my insider activity will be 50% as much as the non-insider activity. [clears throat] Now I run the model. Uh it's similar like I'm running uh again logistic regression with smooth apply. These are my numbers.

Accuracy is around the same right 99.51. There is a slight increase in recall and precision. Obviously if precision and recall increase F1 score will increase. But is that enough? No that's not enough. I cannot productionize this model. Right? But there is a slight increase. Now let's talk about the last one. Last technique here.

The last technique is very easy to remember. It's called cost sensitive learning. It is like penalizing the model. What you're doing here is you're penalizing the model if it wrongly classifies an insider activity. Basically you're applying a weight, right? Every time model make mistake in finding once you're applying a reach. What does that do? There is something called you know the whole process will repeat repeat sometimes called backward propagation. It's like looping the whole thing. Right now once the model makes an adjust makes a prediction it will go back and then based upon the mistake it had made in the first iteration it will try to fix that fix the the parameters to make the second adjustment. Now what

model does is what costs sensitive learning do is every time it makes a mistake it is applying a weight right to the model so that model next time in the next iteration will try to classify the minorities correctly it's it's a algorithm level fix smooth that level fix this is an algorithm level fix so how do I apply that Pretty straightforward. I have defined a weight. Now then what I'm telling here is if it's wrongly classify zero, I don't care, right? Give a weight of one. If it wrongly classify one which is insider activity, apply a weight. Okay? So that model can recorrect it in the next iteration. Now after applying that these are my

number accuracy dropped, right? Accuracy dropped to 61. Recall is 04 right almost 50%. What does that mean? Well, it mean the model successfully manage to detect 50%age of the insider activities. Well, that is a big jump, right? You know, check the other other two methods. That's a massive jump when compared to other two other two algorithms. But can I productionize this model? No. Why? Because see the precision it's a very long if I production I this model sock will be flooded right sock will be flooded it will be a real needle in a h stack so the sock will be flooded but obviously it will find some insider activity but nobody has if it's a flood

and one or two insider popped up here and there that might go missing right so I cannot productionize this model also right So

all right so going back right what have we learned here baseline model only only has very high accuracy it doesn't mean anything it has a very poor I mean almost zero right it's almost zero it's zero zero precision weight by front score now the second the data level fix slightly increase the recall and precision but again not a production worthy model. Now the last method the cost sensitive learning obviously it increased the recall to almost 50%age which means it successfully found 50% of the insider activity but with a very low precision right can I make the model even better yes I can right there are so many other methods right I can make the model even

more better like I can make it maybe like 70% I don't know I haven't tried this with the algorithm but there are so many methods out there by which you can make the model perfect. There are actually hybrid methods specifically for cyber security. I mean these are not no part of my research. There are so many methods you can apply here to increase the model but none of them will be perfect. None of them will be as good as say model from the medical sciences which I mentioned. None of them will be that perfect. The answer to all this problem is not finding a model with the very high performance. It will always be identifying the model with the best turn

the best you know tradeoff that that's all right. I mean you cannot build a perfect model when the class when there is class imbalance but obviously if you can identify the right trade-off you can live with it. That's all. That's pretty much it. THANK YOU. >> [applause]

>> I THINK THE SAME THING. YES, same conclusions. Uh but I tried a different approach. I tried different methods for uh generating synthetic data. >> Yeah. >> But I go to same conclusions there's always a trade-off. >> Yeah. Yeah. There is there is but there are so many other methods you can fix it like like I said cyber security. What you can possibly do is uh something called like context enrichment right try to increase the true positives even before it reaches the model right that's the 99 steps I mentioned earlier you can do a lot of lot right if you are good at you know EDA like really good at EDA not the data science EDA security wise EDA

so that's that's a whole different thing right you every time you think about EDA you go to think about kegel right the kegel.com that's not how to do EDA for security. If you can perfect, if you can learn the EDA really well and if you have a good support from SOCK where they label the data really well, you can increase the number of repositories. >> Uh, sorry, we need to cut it. There's one last presentation that's going to happen up in track one. So, if you want to view that, I'd say move upstairs cuz they're going to start in about 30 seconds. Thank you. Thank you for the presentation. [applause]