Reduce, Reuse and Recycle ML models - and the security powers is yours

Presented at BSidesLV 2019, Aug. 7, 2019, 2 p.m. (55 minutes).

This talk comprises two parts: How to reduce Alert fatigue in security analysts so as to automatically fuse alerts from disparate log sources; and How to Reuse/recycle ML models from one security domain to another. Both systems are in production in Azure Sentinel, Microsoft's Cloud SIEM. Attendees will takeaway three core concepts: how to encode uncertainties in attacks using probabilistic kill chains; compressing ML models using high capacity LSTMs; and finally the trials and tribulations of building large scale ML systems for security.

Presenters:

• Ram Shankar Siva Kumar
  Ram Shankar is a Data Cowboy in Azure Security Data Science at Microsoft, working on the intersection of Machine Learning and Cyber Security. Ram is also an affiliate at the Berkman Klein Center at Harvard University, and Technical Advisory Board Member at University of Washington. He graduated from Carnegie Mellon University with a masters in Computer Engineering and a second masters in Innovation Management.

Similar Presentations:

• DeepSec 2020 „The Masquerade“ / No Need to Teach New Tricks to Old Malware: Winning an Evasion Challenge with XOR-based Adversarial
• CactusCon 12 (2024) / A cactus coup at the goldrush saloon: swindling machine learning caches via wagon train
• DEF CON 32 (2024) / Incubated Machine Learning Exploits: Backdooring ML Pipelines Using Input-Handling Bugs