Making Sense of Web Attacks: From Alerts to Narratives
•
1 gostou•1,686 visualizações
This document discusses using machine learning to generate attack narratives from security alerts. It proposes clustering alerts into narratives using unsupervised machine learning to aggregate millions of alerts into thousands of narratives. This reduces the analysis load on security teams. Real-world data from a large company showed clustering reduced alerts by a factor of 1,000 while still revealing meaningful incidents like a Struts code execution attack. Domain expertise is needed to select features, metrics, and algorithms to produce useful narratives.
Recomendados
Recomendados
Mais conteúdo relacionado
Mais procurados
Mais procurados (20)
Semelhante a Making Sense of Web Attacks: From Alerts to Narratives
Semelhante a Making Sense of Web Attacks: From Alerts to Narratives (20)
Mais de Imperva
Mais de Imperva (20)
Último
Último (20)
Making Sense of Web Attacks: From Alerts to Narratives
- 2. Making Sense of Web Attacks: From Alerts to Narratives • The problem • Suggested solution – Attack Narrative • Real world data Agenda
- 4. Making Sense of Web Attacks: From Alerts to Narratives Security alerts volume is increasing Attack sophistication is increasing Shortage of security talent/ need for higher productivityNeed to: Analyze new threats Adjust security mechanisms Keep WAF updated with new trends Verify all is working correctly - reports
- 5. Making Sense of Web Attacks: From Alerts to Narratives SIEM WAF Anti- Virus Active Directory • Security Information and Event Management • Ineffective • Correlating WAF security events with other devices alerts is meaningless • Aggregating WAF alerts requires WAF expertise Existing solution - SIEM
- 7. Making Sense of Web Attacks: From Alerts to Narratives • The alert captures the suspicious request • The narrative captures a wider phenomenon like source, intent, method, tool • Machine Learning Attack Narrative “SQL injection attack on 18 servers from 192.168.0.0/24 (11.3K alerts)” Alerts In millions In tensNarratives
- 8. Making Sense of Web Attacks: From Alerts to Narratives • Medical imaging • Face recognition • Social network analysis • Market research • Transcriptomics • And many more… Unsupervised ML - Clustering Narrative 1 Narrative 2 Narrative 3
- 10. Making Sense of Web Attacks: From Alerts to Narratives • Characterize attackers & attacks • Feature selection • Distance metric • Clustering algorithm • Incidents prioritization Domain Expertise
- 11. Making Sense of Web Attacks: From Alerts to Narratives Domain Expertise • Characterize attackers & attacks • Feature selection • Distance metric • Clustering algorithm • Incidents prioritization
- 12. Making Sense of Web Attacks: From Alerts to Narratives • Characterize attackers & attacks • Feature selection • Distance metric • Clustering algorithm • Incidents prioritization Domain Expertise
- 13. Making Sense of Web Attacks: From Alerts to Narratives Security alerts volume is increasing Attack sophistication is increasing Shortage of security talent/ need for higher productivity Reduces amount of items to investigate Tries to reveal things we know that we don’t know Automate analyst work
- 14. Making Sense of Web Attacks: From Alerts to Narratives WAF Security events Application SQLi Scan: 993 SQLi attempts from IP X during 6AM-10AM Distributed XSS: 3,400 XSS attempts from 20 IPs 7:00-7:01 Scan: 2365 various alerts from 2 Ukrainian IPs 08:02-08:05 Profile Issue: 1,050 SQLi alerts from 50 IPs 09:00-10:00 Manual Attack: 725 SQLi alerts from IP x 11:00-11:20 … Attack Narrative Unified Management
- 15. Making Sense of Web Attacks: From Alerts to Narratives Report Identify AnalyzeAct WAF Attack Narrative WAF • End-to-end system • Real time • Forensics Feedback System
- 17. Making Sense of Web Attacks: From Alerts to Narratives Application #security events per day 1 475,176 2 219,679 3 180,302 4 143,253 5 126,578 6 96,683 7 91,212 8 83,924 9 69,401 10 65,459 11 56,484 12 52,577 13 52,407 14 48,544 15 43,938 16 42,904 17 42,367 18 41,341 19 37,325 20 35,699 Top 20 Imperva Soc applications with highest #security events per day (averaged on 4 days) App Index # Security Events (Input) # Incidents (Output) 1 33,872 11 2 100,000 24 3 18,789 16 4 27,688 20 5 64,517 19 Average 48,973 18
- 18. Making Sense of Web Attacks: From Alerts to Narratives • Track IPs, users • Track entities: UA, specific parameter • Track time activity • Track volume • Search external information • Correlate with reputation services • Cluster geo-locations • And more… Vatican Attack Data
- 19. Making Sense of Web Attacks: From Alerts to Narratives Struts Remote Code Execution • We found one narrative in a daily analysis • 81 security events • CVE-2013-2115: Apache Struts Code Execution • 2 IPs, Same class C
- 20. Making Sense of Web Attacks: From Alerts to Narratives • Attacks are complex and generate many indications • Identifying attacks by tracking individual indications is time consuming and beyond human capacity • Indications must be aggregated per individual security layers before correlated with indications from other layers Summary
- 21. Making Sense of Web Attacks: From Alerts to Narratives • Unsupervised machine learning can be applied in order to achieve aggregation • Domain expertise must be applied to the machine learning algorithm in order to achieve sensible results • Application to real world data produced 1:1000 aggregation Summary