Let's get started.
I do want to give you one final warning.
This is a talk about defending.
I'm not breaking anything; you might have stumbled
into the wrong room.
I am trying to build something here, not like an android malware thing
people will patch tomorrow.
This may potentially change the game and help some problems dear
to my heart when it comes to defending Blue Teams and things.
Also, there is a lot of math involved.
It's not like people will start a riot or throwing things,
but if you haven't had lunch, you may experience difficulties
because it is not good to do math on an empty stomach.
I just want to give a quick note to where I am coming from.
A bit ever this presentation will be a little randy
because of the experience.
I have been in security for 12 years, and why you have never heard of me,
I did most of this in Brazil.
I used to work with one of the largest consulting
companies there.
What I did the most was actually leading SOX,
putting operation centers together and building log management systems
either inside of a company, or inside one
of the huge massive SOX which you have seen.
This is trying to make day to day management and defending
work, and then I got into machine learning.
I thought it would be a very interesting subject to help
the problem we have been facing.
This is my first presentation.
I do want my "shot" perks of the job.
Don't tell my employer, but I used to drink all the time
before my presentations!
Excuse me.
Anyway.
Here is an overall structure.
I will talk about the problem and about machine learning
to make sure we are on the same level, not to dazzle you with math shit
and just say it works.
I want you to get the basic feeling, and this is not introduction
to machine learning 101, I don't have four hours, and
besides it isn't that cool.
I just want to make sure we understand where
machine learning is coming from and the special considerations
for security learning which is important.
Most experts or data scientists will not understand this point, and
a bit of the case study goes through the process
of an algorithm I designed.
So let's get moving.
First, you all learned of log management.
You have a lot of logs, certifications, best practices; it is everywhere
and you have to deal with it because everything
is generating logs for you.
The problem I have, having worked with a lot
of SIM and management solutions, nobody is happy.
Everyone is deploying this, doing everything they can
with the state of the art stuff, and you can quote Gartner that 93%
of the organizations couldn't catch the breeches they had.
It can't be all that bad, can it?
That is going on here?
I got this great graph from SANs, and I have no idea what
the horizontal markings are, but the first one seems big so I
will just take their word for it.
But what really caught my eye here, what is the biggest problem
in SIM deployments?
It seems you can't identify key events from normal behavior.
Maybe it is a pronunciation issue, but security information
and event management solutions.
There are rules doing fancy shit, putting graphics on and trying
to pretend you understand that the logs are talking about.
But the point here, my biggest problem
is that I cannot tell key events from normal behavior.
It is like you buy a car and the main complaint
is you can't get from point A to point B.
The car doesn't start, I can't find the accelerator.
That is why we buy these things, and we're not able to make them work.
One reason I think we can't make them work, how do you use these things?
You are coming up with magic numbers where I want
to be a learned, if somebody hits me like five times
or maybe I am home free if I only hit you four times.
I am trying to make up arbitrary rules where
if something happens and then other things happen, that
is an alert that should be brought up to me.
In a way, all the permeations of the rules people put together,
and when you are on an engage the, you are just iterating
until the customer is satisfied or until you run out of money, which
is more likely.
It sounds like a scheme to me, like it was built
to make sure we generate the most consulting out of that,
and I don't claim that SIM solutions are the largest offenders.
If you have worked with identity management, these guys,
they take the crown.
The point I want to make, one of these vendors has
a huge curriculum.
You get one month of training to be an expert with the solution; four weeks,
20 days, and not one single hour of the training explains to you
the content it comes with.
For weeks it will teach you how to build new rules and create new
dashboards and new things, but how do I use these things
and apply them to what I need to do?
So it seems like things are harder than
they should be.
I do want to touch on behavior rules, as I will talk about them a bit
in the future as they help a bit with the configuration.
So I'm not ready to bash the tool, but some people are very, very good
at log management, but there are very few.
I have worked with teams which are very good.
You give them six months and they would make this thing sing.
But the problem I have, this does not scale;
we do not have enough people who are good at this, at understanding
all of that.
Those are fantastic tools if you want to build something,
but they are not ready.
Most people buy them thinking they will be ready and
will solve a problem, but it's not there, definitely not there.
What really got me scared was Big Data.
And the point is, we have this smallish database,
so thinking about SIM solutions, this is nothing more than
a highly vertical business data warehousing solution from the '90s.
But now they are catching up to have better data by day,
but who will analyze it?
Do we have to create all the rules ourselves?
Usually when you handle this kind of data, you need to work
with statistical analysis.
It is really is whole different discipline from your traditional information
security analysis, and I have met people who are very
good at both, but it makes the bowl even smaller.
Given all this, the only solution at this stage I can tell you about,
we need an army.
Let the rule bots talk to themselves.
If there is a machine that is generating the data,
why shouldn't the machines read it?
We can't keep up; there's just no way.
That is when we talk about machine learning.
I want to get the basics right so that we can
understand a lot of what we can and cannot do.
We really haven't got to this stage yet, but I have met people who are intent
on building this, yes, put the machine learning thing together
and it will be awesome, but I'm just not exactly sure about that.
When you think about machine learning,
you really aren't writing the code for the decision making;
you are writing a code that will identify some data for you,
and then start to make inferences based on the data.
So pretty much like going to the computer and I say: Computer,
this is a chair.
The computer will look at the chair, okay, it has metal and some stuffing,
got it, it's a chair.
But this is another chair.
Oh, that is a bit different, but I think I have the idea.
As you show the computer enough chairs,
it eventually begins to generalize that a chair is.
The secret is all in how you tell the computer that a chair is,
the science slash art around this, how you build the features
for the algorithms to be able to take this
in and make decisions based on what they saw, if something
is this or that.
I will give many more examples.
This is everywhere, absolutely everywhere.
I think it is a shame we don't use information
security more.
Everyone is selling you shit out of this.
You go to Amazon, one of the big examples here.
They use this technique called "collaborative filtering" which pretty
much says okay, if you buy these things with a lot
of other people just like you who bought these things,
but if they bought something else, I will probably suggest that you are
pretty similar.
So it will make decisions.
If you look at the math, there is a billion matrix column and
they multiplicate the hell out of that shit,
and you should read this book; it is quite awesome.
This is something that is very well understood
by the marketing and sales community.
When you talk about trading, and this is a very good picture, but it
is a cautionary tale.
This was a flash crash that happened
a couple years ago where most of the high frequency trading run, it
is just algorithms talking to each other and buying
and selling based on what is happening.
And then some of them got confused
and almost crashed the whole community,
but luckily somebody was watching and said let's back up a little bit,
you guys play nice now, let's separate this.
But it is everywhere, and it is a very sensitive place.
On the other hand you have people doing very cool stuff with image
and voice recognition.
(Applause) Should I continue?
Evidently he is the only one who does not know
why we are here or what we are called.
Is this your first time speaking at DEF CON?
ALEXANDRE PINTO: Yes, sir.
Welcome.
We would like to shove some alcohol
down your throat.
Raise your hand if you are a first timer.
You in the blue shirt.
You were faster than everybody else.
Sunday morning at DEF CON; gotta love it!
What is the shit on the screen?
My God, that is really cool.
Data visualization of some kind.
To all first timers at DEF CON, cheers!
(Applause) We will see you soon.
ALEXANDRE PINTO: Now I am happy.
I guess we can continue.
Anyway, the guys from Google set up like 16,000 cluster machine,
telling the machine to find me pictures of cats
on the Internet.
Yes, they really know their audience.
(Applause) So they use a technique called "deep learning"
to actually create an arbitrary, deep and narrow network out of the blue.
I don't claim to understand it, but it is mighty fancy.
This is a visualization of that a computer thinks is cat is.
That is awesome.
I can see a cat there.
This is the future, man; the computer is watching cat videos now.
(Laughter and applause) But on a more serious note, what
is this being used for?
Security.
Fraud detection systems, the most basic technique they use
is called clustering which I will talk more about, but trying
to find deviations on a pattern.
If they create a baseline and identify where you are
with a group of customers, if you are not "you" in the dimensions,
they can look at that.
If you used to do this kind of shit with a credit card
and you do something very different, that is probably a flag.
And behavior monitoring, no matter what people say, it
is not machine learning.
The HP12 can do rolling averages, very easy to do.
Statistical analysis is helpful, and it is the first step in understanding,
but it isn't machine learning in any way or shape or form.
Finally, spam filters, the heros of some machine learning.
You remember the Beijing filters?
That is actually the algorithm they use.
The point I am trying to make, how many talks did you see this year
or the year before about spam?
Nobody is researching that anymore.
I know I have my gmail account I opened in 2004, a long time ago,
and I am sure every single spammer on the Internet has hold of my account.
I don't get spam.
Do you get spam on gmail?
I got phishing e mails which are crafted to look like a normal e mail
to get passed all this.
And this is a problem we really don't look at anymore.
10 or 15 years ago I did research for a talk, a paper
from 1998 talked about using Beijing filters for spam,
and it seems like the problem is solved in a way.
That is a message I want to leave there.
If we start doing this work now, we will get very good at picking
up this stuff in five or ten years.
Once you have enough data, and I think Google would be
the one who has the most data; we can probably agree on that.
You can get pretty good at this.
Anyway, now we start getting a little bit more technical.
The idea, there are two big kinds of machine learning: Supervised
helping where you tell the computer that these things are,
and there are two major groups.
Classification is like this is a chair, this is a table, budge of chairs,
bunch of tables.
Okay, here is an object, what is it, a chair or a table?
You pretty much give it data to train on, and you give it labels, this
is a chair and this is a table.
Then for it to predict, you present new data.
When we think about regression, we aren't actually looking
for a binary answer, but we are looking for how much
of this is a table and how much is a chair?
I know it doesn't Sunday like it makes sense, but if you look
at a stool or a piano bench that looks like a table,
the computer would get confused, it is a dot four chair, and I know that
is a general example.
But trying to generalize where it lies, and based on that and this
is definitely a chair or a table, we can use it for that,
or we can use it to make the humans better informed
on what decisions they should take.
Then there is unsupervised learning which is okay,
I don't know anything about this, look at this and tell me what you can find.
There are also to big groups.
There is clustering which I mentioned before with regard to fraud solutions,
by far the most abused machine learning
technique for anything ever, and it is not always applicable and has
a very fatal flaw.
You have to actually tell the computer how many clusters you
are looking for so it can be able to guess which would be
the separation of the data you are sending.
Of course, there are techniques to discover that,
but then it starts getting very complicated and most
of the people don't actually do all the legwork and it can get a bit fuzzy.
Finally, the composition.
In a way, it is a tool for you to design better algorithms,
in a nutshell.
So I need to tell the computer what a share
is and I have all the different things to tell the computer,
height and weight and what it is made of, so
like a hundred possible variables.
And I am trying to find which ones matter the most
in deciding if something is a chair or a table.
Maybe it can be argued for chair and table, it can be the height.
Probably if I ran the chair table model
on a composition thing to tell me the principle components analysis
of what is really making a difference, it would probably say height should be
chosen for the model because it makes
an awesome difference.
By the way, if you like this tutorial, it is awesome.
So it is not magic; you still have to train the computer and give it data.
But if you design your algorithm and your model well,
with more data it will generally get better.
So there is a lot of mathematical proofs that you can
show that the more data you have and this is the drawing on the left.
Your E in which is the arrow inside the training model,
the data you are using to train, and both of the E which
is the stuff you have never seen before in your life, they converge
to an expected error.
Don't let anybody tell you there is a hundred percent working machine
learning model; no such thing.
It will make mistakes, as do we.
It is all part of the way we make sense of reality,
trying to emulate it into a computer.
There will always be errors and you can all hope your model
will be as error free as possible.
The point is, you must be careful about the data you take in.
For example, the SANS D shield data firewall you get
from them, they wouldn't tell me but I assume it is pretty U.S.
centric, putting a bias on the results.
But you always have to be aware of that and to look out for adversaries,
which is a point I want to make in my talk.
Everybody who is into building these models, doing
the machine learning, they don't understand that people
would like to really fuck with them, which we do understand.
And one of the first things that came to my mind, even
if I build something here, how can I potentially exploit
or send random noise to render the computer useless?
And I will take a bit about that as a weakness
of this specific model that I built, but it is there; people will try
to mess with you.
If this becomes a valid method of actually defending
and helping defense, there will be a lot of talks in this conference
with some really crazy math guys on how they will defeat this,
crypto wars all over again.
But the point is, remember spam engines?
When we started getting this Beijing thing going on,
the spam just started posting whole sonnets of Shakespeare at the end.
And then the model will think hmm, I haven't seen many spams
with the word "thou" so it is probably a legitimate e mail.
But then people refined it and evolved the model to get
to the level where we.
But people always find a way to break things, and especially
on these kinds of applications, this is something we need to be very,
very careful about.
Enough introductions.
Let's get to it and to chewing on the logs.
Most of the talk is about the feature engineering,
the really important part here.
On that slide about the kinds of machine learning are names
of algorithms, and there are a whole bunch of them.
You just try them all, you create a process
to see which works best because there is no one size fits all,
but the problem is what data you are feeding it.
And everyone will tell you that is the real hard work about this.
So I was telling you about this shield.
I have been collecting their bulk logs, and on the website you see
the top ten places where bad people come from on the Internet.
But if you ask nicely and they were very nice about it, I thank
the SANS institute for their help, and you can get the bulk data
and I just started mining it in January.
This is very basic stuff, which is one of the points I am trying to make.
It is firewall data that is blocked and summarized.
I get to know kind of how many blocks we got for each,
which I use as a way to decide what to select for the model.
But that is all there is, which you know.
For the group of people submitting the log files, these are
the guys who were potentially attacking them; right?
You always start with a port scan to see which machines were up.
If people were hitting them on the firewall
on machines that didn't have a port open, maybe if they hit
the write board, it would be something worth looking at.
Just a summary here of the amount of data.
Per day I got a million observations, which is pretty much this IP address
attacked this port.
From that, I would select the behaviors I was looking for.
When you decompose that and I didn't get the decomposed logs,
only a number, you would get roughly 30 million log
events per day.
One thing to point out here, this is not Big Data.
I am running it on my laptop, and it's not even a good one.
So don't let anybody tell you my God, it's the Cloud.
I am really trying to bring to a tangible level, which
is one objective of this talk.
I am getting some data, doing mining with it on my own laptop.
So one of the intuitions here of this model, it is the proximity.
Anyone who has done this, they have an instinct like okay,
I have seen this IP address before or I have seen people coming
from "that side of the woods" before, and it is interesting
because I have seen a lot of things being caught out of mistakes.
People would look at IP addresses and say oh, I remember this guy,
let's look at this, but it was an IP address that was similar,
had never appeared, and there is actually something there.
I started doing research, and there is some statistical analysis facts
about this.
I point out the spam house cyberbunker thing, I don't care about that,
but I care that spam house said to forget about the ISP,
anything that comes from there, it is spam, just block the whole thing.
That is an interesting conclusion, and they really fight to be level headed.
(Comment from audience member)
ALEXANDRE PINTO: I don't know anybody from there; I
will take your word.
Then we got the Google malware report that said
there are more places that are likely to have malware.
And then a researcher did a statistical analysis
for the past seven years of logs from the Brazilian research networks
that connects the universities.
He was proving that shit statistically, and it's not random at all.
There is some information you can potentially
extract from that.
To create my features, I started grouping those logs
by arbitrary net blogs, so let's pick some things
and choose and see if it comes out all right.
And by ASN, which is what really shines,
the synchronous or automatic system where it is coming from on the Internet,
and for that I use this awesome service for pulling that data.
Here is a visualization of that, and I know it seems like a lot to take in,
which is understandable because that is the Internet, but this
is a projection that tries to maximize the proximity as you draw
the IP address.
This is called a Hubert Curve, and this is the transformation,
thinking of the IP address like in a straight line
from zero zero zero to 2555 blah blah blah, twisting
to make sure the IP addresses are as close as possible to that
of their neighbor.
And this is accumulated data up to July 20th of people trying
to attack the D shield group on 4/22, and I don't think that is random.
Some places on this map, by nature they are dark.
The DOD is really not doing anything there, but they have like eight blocks.
IBM has 8 dot something, and they don't use it.
You can see there is some density going on, and
if you are in the DEF CON network, if you look at this cluster,
you can start to jump to conclusions.
Oh, my God, look at this guy, he's obviously up to something.
Then you start doing more mining, and oh my God, they are definitely
up to something.
This is data, okay?
But the point I am making, it is very easy to start jumping
to conclusions, but we need to see this to fruition at the end.
If you look at it, you see it is us, pretty much beating the shit
out of each other all the time.
So I make the point that if you are just blocking
for I hate this country, I won't let it in, it won't mean anything; you just need
to be careful about that.
So let's get moving.
So we get this, there is proximity, but I want to be able
to decay it because the neighborhoods
may renovate.
If people change ISPs, I want to accompany that; otherwise, it
is just a massive black list that will eventually block
off the whole Internet.
So as time passes I want to forget these things happen,
and there is some exponential decay here.
You choose a metric, and after three to four months,
it really doesn't happen anymore, you forget that people were
attacking you.
And that is just like an analyst, like if you go
to a party and something happened a month ago, you aren't as likely
to remember it as you were if it happened just yesterday.
So given the two intuitions, we have to start calculating this.
The point is, we crate rankings which will be
the features to the model by IP address, by some net blocks you choose and
by the SANS.
If you are missing data, I take a shortcut,
if I can't discover your ASN, you are a bad man and I
will give you a high score.
It is a shortcut but it makes sure we don't ignore these
people which might be bad in a scenario like this.
The point is that for each day that happened based
on the time series you saw, we are going to have a calculation.
So this is what happened on this day.
Then the following day we will actually decay this by the function,
the exponential function.
And then we add what happened the following day,
pretty much adding one.
This happened this day, this happened that day,
and we go decaying the rest.
The importance of having this history, if we're using log data to detect stuff,
data logs will have dates.
I can't use future calculations with things from yesterday;
it doesn't make sense and the model won't make sense.
It will tend to survivorship, which is a routine thing.
So you have to make sure you are pairing
the data you have with the features you have.
The visual scale is actually a log scale.
When you see "6" there, it is a million.
If you get 1 on this score, the horizontal access,
it means that you were hitting me every single day.
I found it pretty interesting that you could get at least 10,000 guys,
and this is RDP hitting me every single day.
And even if I was using that as a black list, which
is a perfectly valid way, look at all the guys I am ignoring,
which doesn't mean anything compared to the data I have.
And on No.
22, you can see the similar behavior.
There will be guys out to get you, but if you only look
at the daily black lists, there is so much information that you are
leaving behind which can potentially be leveraged to help you
with that you are doing.
Are we good?
Too much math?
We can fix that.
(Applause and Laughter) ALEXANDRE PINTO:
I'll never finish.
Enough with the math bullshit; time to drink!
Wait a second.
Didn't we already do a shot with you this morning?
ALEXANDRE PINTO: Not this morning; you just came
to this room a few minutes ago.
Is your accent Russian?
ALEXANDRE PINTO: No, Brazilian.
Maybe we just want to drink!
(Applause) Is this your first time?
You did a shot?
ALEXANDRE PINTO: Yes.
Fuckin A.
All right.
We've clearly lost track at this point.
What's your name?
Steve.
Steve, this is everyone.
STEVE: Hi everyone.
Here is to Steve, a first time attendee.
(Applause) I guess we will be back in five minutes.
ALEXANDRE PINTO: Let's try to get close to finishing.
The point is, we have a bunch of numbers.
But we know with this bunch of numbers Back to the math.
ALEXANDRE PINTO: Sorry, guys.
We should do a drinking talk.
So we get the features calculated, and we pair them
with the data that we have.
The assumption is if somebody hits the firewall, they are out to get you
and they should be considered bad.
So you put these guys on your training model,
so pretty much the IP address, the features that you calculated.
And then you feed that to the model.
Usually you need more than one day, and that is why separating
the ranks makes sense on the database
to make sure you pair the right day with the right data that you are using.
So rule of thumb and it all depends on the algorithm that you are using.
But the point is, you can't always have malicious data;
you need good data too.
Otherwise, the computer will say: Yay, everything is a chair.
So I took a bunch of IP addresses from Alexa and Chromium
to make sure we got to paired up, and the last was 50/50.
I won't go into the algorithms, but support vector machines are
awesome and do math people don't even understand.
It is like the mathematicians saying I think there
is an infinite dimension that makes sense, but I don't care,
I just calculate it and it makes sense.
That is scary; scary as fuck.
Here is the point.
So we train this every day.
I have a bunch of ports.
What is happening on Port 22 and 338 and Port 25?
And I would get something around 83 95% training courtesy,
which is what I get right.
So bad is bad, good is good, and then divided by the number
of things I gave it to process.
And this is good, but it is not really accurate because,
especially if you are using time sensitive data,
this is a technique called cross validation
which doesn't work very well for that.
So I looked at the following day.
And this is the point.
I did all this calculation for today, who are the guys most likely
to be attacking me tomorrow, based on all this data?
And I would get something from 75 85% which I
will break down so that you can really understand what 79 95% man,
this is hard.
Anyway, just an idea of the progression.
You have to run of course, if you have a model from February
and you try to run it from something that happened in July,
if you do that, you will have a terrible time.
That is because a lot of things have happened,
and it also shows a bit about the "moving about"
of the environment, and blah blah and blah blah, yes, same shit.
The month I am trying to make, it is 79 to 95, okay.
What is the bad stuff I got bad and the good stuff I got good,
so true positive and true negative.
So the numbers are a bit slow.
As you see, the true negative was really bringing it up.
I think once I get different data, it should even it out.
But the point is, if you calculate this, given the error rate,
something this picks up in your logs and says you should
look at, it is about 18 time more likely to attack you than all the rest.
So wouldn't you think you should look at that first?
This is not catching everything, and neither are the analysts,
you know: Spoiler alert!
But if you have time constraints, and people have so much time
because they have to eat and sleep, it is terrible, labor laws.
But let's try to make this a bit easier.
And this is where it is coming from.
This is an idea of prediction.
So I am just it is the same curve that you saw before.
I am sampling a hundred KIP addresses
from each place.
So the brighter the tile, the more likely the people
will be attacking you.
This is a logarithm rate, so it is go like tens of thousands, and this
is the deal, guys.
So you see, it is everywhere.
Challenges.
IP addresses are bad, the worst thing to use for instant response.
The point I am trying to make, even with the real shitty stuff,
we can get some interesting results.
If you are coming from TOR with a lot of clustering, it messes it up.
If I change the IP address every 30 minutes,
fuck you.
But I believe if you can reduce the cycle, so it
is a daily resolution which you can begin to get smarter.
So I wouldn't just go on IP addresses; I would go on different stuff too.
So what I am trying to say in it is potentially help security analysts,
bringing a new dimension for software, and these are
the guys most likely who are out to get me.
So let's invest some time in that.
What is cool, I created a model for firewalls, and I could do
the exact same thing for IPSs and WAFs.
And if I take the inference each individual gives me
on the IP addresses.
Then I combine them, I can say this guy is 200 more times
as likely to attack you; then I would block this fucker.
This is the kind of confidence you are trying to build.
"
Blocking" is a bad word in information security, especially
if you are defending, but maybe we can get
to that confidence.
And the way I am trying to do this, there is actually a project.
So you send me data, and I send you a report.
And the point is, the more data I have, I can start to fight the bias I got
from the SANS database.
There are URLs, there is a Twitter feed.
You can look it up, but I will be around.
Take aways.
It is not a monster.
Of course there is marketing hype, but it can help.
I think 13 to 18 is pretty good.
Thanks.
(Applause) ALEXANDRE PINTO: I will be at the Chill Out Lounge
if you want to ask questions.
Thank you very, very much.