Upload File

cyber threat detection and interpretation

10
Detecting and Interpreting Cyber Threats at AT&T © 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement. Cyber Threat Detection and Interpretation Making Sense out of Big Data

Upload: hadoop-summit

Post on 19-Feb-2017

163 views

Category:

Technology


4 download

Report

TRANSCRIPT

Page 1: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Cyber Threat Detection and Interpretation

Making Sense out of Big Data

Page 2: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Near Real Time Anomaly Detection and InterpretationData arrival triggers dataset generation, analysis, alerting, and visualizationSome outliers are obvious and warrant further analysis and investigation e.g. 426GB of application traffic in a 15 minute partition

2

Page 3: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Threat Detection through time serial analysis, outlier detectionSome outliers are not so obvious, further analysis detects application outliersApplication traffic associated with one application produces an anomaly (e.g. 115GB traffic for one application in 15 minute partition)

3

Interpretation of Anomalies Produces AlertsAnalysis of high traffic anomaly reveals external SSH sources, alert is generated

External SSH Connections

Page 4: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

4

Near Real Time Anomaly Detection and InterpretationPotential threats are grouped for outlier detection as a result of summary statisticsExtensive graph development and traversal is required to group potential threats together for analysis

Once the correct group is formed, anomaly detection can commence

Page 5: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Near Real Time Anomaly Detection and InterpretationOutlier Detection Identifies Anomalies Statistical analysis to determine behavioral values that are a-typical and/or impossible (e.g. number of logins)

Time Series Analysis Interprets non-human behaviorsHundreds of logins within 15 minute intervals is non-human behavior

Alerts are Generated for Analysts

5

Page 6: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Insider Threat

A Potential Use Case for Outlier Detection

Page 7: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

Insider Threat Use Case

7

Data Arrival Triggers Extraction into a Data ModelEntities, relationships and features are collected, aggregated and analyzed for outliers

Model Features Build a History of Data Transfer and Statistical Baselines are Calculated

Page 8: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

8

Insider Threat Use CaseOutlier Detection Identified Data Transfer AnomalyStatistical analysis to determine behavioral values that are out of character (e.g. bytes sent)

Time Series Analysis Interprets the Data Transfer Source Source and time frame was identified as an outlier

Alerts are Generated for AnalystsAlert was generated for further analysis with pin-point details

Remediation/Correction Action was TakenTarget was identified and corrective action taken

Page 9: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.

9

Wrap UP

Hadoop Based Threat Analytics PlatformOutlier Detection and InterpretationQuestions

Page 10: Cyber Threat Detection and Interpretation

Detecting and Interpreting Cyber Threats at AT&T

© 2016 AT&T Intellectual Property. All rights reserved. AT&T, Globe logo, Mobilizing Your World and DIRECTV are registered trademarks and service marks of AT&T Intellectual Property and/or AT&T affiliated companies. All other marks are the property of their respective owners. AT&T Proprietary (Internal Use Only). Not for use or disclosure outside the AT&T companies except under written agreement.


Cyber Security Threat Landscape

Wittaya Janmayka 8 December 2016 - Enterprise IT Pro Cyber Threat... · 2016 Cyber Threat Observations. Cyber Threat Predictions Tipping Point For Cybersecurity in 2017 . 4 Cyber

Operational Cyber Threat Intelligence:

NATIONAL CYBER SECURITY CENTRE CYBER THREAT REPORT …

1.Current Cyber Threat

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Cyber threat alerts 2011

Cyber Threat Intelligence Enterprise & Cyber … Threat Intelligence Enterprise & Cyber Security August 2017 Copyright Fujitsu Limited 2017 Global Impact Fujitsu Cyber Threat Intelligence

IBM Cyber Threat Analysis

THREAT REPORT - Cyber€¦ · The Australian Cyber Security Centre Threat Report 2015 Foreword The cyber threat to Australian organisations is undeniable, unrelenting and continues

Cyber Threat Intelligence: Integrating the Intelligence Cycle · Cyber Threat Intelligence: Integrating the Intelligence Cycle Elias Fox and Michael Norkus, Cyber Threat Intelligence

BDO CYBER THREAT INSIGHTS

Cyber Threat

Standardizing Cyber Threat Intelligence …stixproject.github.io/about/STIX_Whitepaper_v1.1.pdfStandardizing Cyber Threat Intelligence Information with the Structured Threat Information

CYBER THREAT ASSESSMENT

Cyber threat trends

HITRUST Cyber Threat Intelligence and Incident ... · HITRUST Cyber Threat Intelligence and Incident Coordination ... HITRUST Cyber Threat Intelligence and Incident Coordination Center

Cyber Threat Framework (Version 4) Translating Cyber into ...€¦ · Cyber Threat Framework (CTF) Overview The Cyber Threat Framework was developed by the US Government to enable

Monthly Cyber Threat Briefing

What is Cyber Threat Intelligence and how is it used?€¦ · 6 What is Cyber Threat Intelligence and how is it used? What is cyber threat intelligence? Cyber Threat Intelligence

Measuring and visualizing cyber threat intelligence quality · Keywords Cyber threat intelligence · Threat intelligence sharing · Data quality · Threat intelligence formats ·

SecBI: Cyber Threat Intelligence

PERMA Cyber Threat Brief

Cyber, Physical or Insider Threat? - ASIS Europe 2018 · Cyber, Physical or Insider Threat? ... navigating a complex risk landscape? physical threat cyber threat insider threat

Cyber Threat Intelligence Report

Cyber Threat Intelligence

Cyber Threat Monitor Report

Cyber Threat Intelligence Training Series · 2020-05-13 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

National Cyber Security Centre Unclassified Cyber Threat ... · National Cyber Security Centre Unclassified Cyber Threat ... It also produces threat prevention and ... can however

CYBER THREAT BULLETIN

Cisco Cyber Threat Defense

Introducing Cyber Threat Monitoring - StarHub€¦ · Introducing Cyber Threat Monitoring A unique, telco-centric cyber defence solution for enterprise Cyber Threat Monitoring (CTM)

Cyber Threat Intelligence Training Series · 2020-03-27 · Cyber Threat Intelligence Training Series Course Introduction and Objective Cyber Threat Intelligence (CTI) Training Series

Cyber Threat Metrics

Cyber Security Conference - Rethinking cyber-threat