1 1 00:00:00,360 --> 00:00:02,010 Data enrichment. 2 2 00:00:02,010 --> 00:00:04,650 In this lesson, we're going to talk about data enrichment 3 3 00:00:04,650 --> 00:00:07,440 and how we can use machine learning to help us with that. 4 4 00:00:07,440 --> 00:00:09,000 One of the best things that machine learning 5 5 00:00:09,000 --> 00:00:11,400 can assist us with is data correlation, 6 6 00:00:11,400 --> 00:00:14,190 because there is so much data across all of our systems, 7 7 00:00:14,190 --> 00:00:15,960 and if we throw it all into our SIEM, 8 8 00:00:15,960 --> 00:00:19,380 it's still a lot of data for us as an analyst to go through. 9 9 00:00:19,380 --> 00:00:21,060 So by using machine learning, 10 10 00:00:21,060 --> 00:00:22,800 we can have it surface up to the top 11 11 00:00:22,800 --> 00:00:24,600 what it thinks is the most important things 12 12 00:00:24,600 --> 00:00:27,000 for us to look at as an analyst. 13 13 00:00:27,000 --> 00:00:28,650 Now, when we do this, one of the things 14 14 00:00:28,650 --> 00:00:31,890 that it can also do to help us is use data enrichment. 15 15 00:00:31,890 --> 00:00:33,750 Now, data enrichment is a process 16 16 00:00:33,750 --> 00:00:35,730 of incorporating new updates and information 17 17 00:00:35,730 --> 00:00:38,010 to an organization's existing database 18 18 00:00:38,010 --> 00:00:39,960 to help improve its accuracy. 19 19 00:00:39,960 --> 00:00:42,540 So if I have my SIEM with all the things I saw 20 20 00:00:42,540 --> 00:00:45,270 in my network, but I don't have any threat information 21 21 00:00:45,270 --> 00:00:48,540 from other third-party sources, I may not catch something. 22 22 00:00:48,540 --> 00:00:50,760 But by taking machine learning and doing data enrichment 23 23 00:00:50,760 --> 00:00:52,680 and bringing all that data together, 24 24 00:00:52,680 --> 00:00:54,270 I can have different open source feeds. 25 25 00:00:54,270 --> 00:00:55,680 I can have other partner systems 26 26 00:00:55,680 --> 00:00:58,320 and my own systems telling me what I'm seeing 27 27 00:00:58,320 --> 00:01:00,330 and that can help me figure it out. 28 28 00:01:00,330 --> 00:01:02,460 Now, AI-based systems can help combine 29 29 00:01:02,460 --> 00:01:05,010 all of these indicators from multiple threat feeds 30 30 00:01:05,010 --> 00:01:06,840 to help reduce our false positives 31 31 00:01:06,840 --> 00:01:09,390 and our false negatives inside of our systems. 32 32 00:01:09,390 --> 00:01:11,490 So it makes our systems even better 33 33 00:01:11,490 --> 00:01:13,680 by using this as an enrichment technique. 34 34 00:01:13,680 --> 00:01:16,560 Again, our goal here isn't to eliminate the person. 35 35 00:01:16,560 --> 00:01:19,110 It's to make sure that the person has the best information 36 36 00:01:19,110 --> 00:01:21,270 to make the best human decisions. 37 37 00:01:21,270 --> 00:01:22,530 Now, let me give you an example. 38 38 00:01:22,530 --> 00:01:24,660 Let's say that I need to create malware signatures. 39 39 00:01:24,660 --> 00:01:25,710 That was my job. 40 40 00:01:25,710 --> 00:01:28,350 I'm a reverse malware analyst, and I'm going to go through 41 41 00:01:28,350 --> 00:01:31,170 and take apart those binaries, decompile them, 42 42 00:01:31,170 --> 00:01:32,850 look at the hex code and figure out 43 43 00:01:32,850 --> 00:01:34,410 exactly what they're doing. 44 44 00:01:34,410 --> 00:01:36,060 And, from that, I can create a signature. 45 45 00:01:36,060 --> 00:01:38,700 So, here on the screen, you can see an example 46 46 00:01:38,700 --> 00:01:41,520 of an old piece of malware called the I Love You Bug. 47 47 00:01:41,520 --> 00:01:43,800 Now, in this one, there were certain pieces of code 48 48 00:01:43,800 --> 00:01:45,780 that you can pull out as your signature. 49 49 00:01:45,780 --> 00:01:47,580 Now that's great, but what happens 50 50 00:01:47,580 --> 00:01:50,010 if somebody changes one of those bites of code? 51 51 00:01:50,010 --> 00:01:51,870 Well, now it has a different signature, 52 52 00:01:51,870 --> 00:01:53,340 and that means I can miss it. 53 53 00:01:53,340 --> 00:01:55,500 And so if somebody keeps doing that by changing the code, 54 54 00:01:55,500 --> 00:01:57,300 it's going to make my job as a malware analyst 55 55 00:01:57,300 --> 00:01:59,520 really, really hard because I'm going to to keep going back 56 56 00:01:59,520 --> 00:02:01,620 and creating new signatures all the time. 57 57 00:02:01,620 --> 00:02:04,020 If I use AI, I can give it a basic signature 58 58 00:02:04,020 --> 00:02:05,700 and say, "This is what I'm looking for. 59 59 00:02:05,700 --> 00:02:08,370 Now, if you find any variations that look similar to this, 60 60 00:02:08,370 --> 00:02:09,660 go ahead and flag those as well 61 61 00:02:09,660 --> 00:02:11,310 because somebody might have changed one bit here 62 62 00:02:11,310 --> 00:02:12,450 or one bit there." 63 63 00:02:12,450 --> 00:02:14,640 And by doing that, we can integrate AI 64 64 00:02:14,640 --> 00:02:16,890 and machine learning to help us still identify 65 65 00:02:16,890 --> 00:02:19,710 what is malicious, even if they change the source code. 66 66 00:02:19,710 --> 00:02:21,990 Now, AI-based systems can really help us 67 67 00:02:21,990 --> 00:02:23,610 as we're trying to identify this malware 68 68 00:02:23,610 --> 00:02:25,380 that's been jumbled up, and it can do it 69 69 00:02:25,380 --> 00:02:27,360 a lot better than our human counterparts. 70 70 00:02:27,360 --> 00:02:29,430 People like me just can't do it nearly as fast 71 71 00:02:29,430 --> 00:02:31,050 as a computer can. 72 72 00:02:31,050 --> 00:02:34,140 So these AI-based systems, though, they do have struggles. 73 73 00:02:34,140 --> 00:02:35,520 They're not really good when they're trying 74 74 00:02:35,520 --> 00:02:38,100 to identify things like administrative actions. 75 75 00:02:38,100 --> 00:02:40,170 So if somebody went in there and did something malicious 76 76 00:02:40,170 --> 00:02:42,810 as an administrator, that's really hard for them to detect 77 77 00:02:42,810 --> 00:02:46,110 because what is malicious about somebody changing a password 78 78 00:02:46,110 --> 00:02:49,290 or creating a new user account or changing a policy setting 79 79 00:02:49,290 --> 00:02:51,000 or moving files around? 80 80 00:02:51,000 --> 00:02:53,700 All of those are normal actions we do on a daily basis. 81 81 00:02:53,700 --> 00:02:56,490 What makes them malicious is the intent behind them. 82 82 00:02:56,490 --> 00:02:58,440 And so if somebody's creating a new user account 83 83 00:02:58,440 --> 00:03:00,480 to be able to have an extra admin account 84 84 00:03:00,480 --> 00:03:01,590 so if they get kicked off the system, 85 85 00:03:01,590 --> 00:03:04,080 they can log back in, that's malicious. 86 86 00:03:04,080 --> 00:03:05,610 But just creating a new admin account, 87 87 00:03:05,610 --> 00:03:07,200 that's not necessarily malicious. 88 88 00:03:07,200 --> 00:03:08,550 That might happen just because I hired 89 89 00:03:08,550 --> 00:03:09,900 a new system administrator. 90 90 00:03:09,900 --> 00:03:11,760 And so you have to think about these things, 91 91 00:03:11,760 --> 00:03:13,470 and this is where humans are better 92 92 00:03:13,470 --> 00:03:15,900 at identifying things than AI-based systems. 93 93 00:03:15,900 --> 00:03:17,610 Now, when you're dealing with your machine learning, 94 94 00:03:17,610 --> 00:03:21,060 remember as I said before, machine learning is only as good 95 95 00:03:21,060 --> 00:03:23,310 as the datasets that you use during training. 96 96 00:03:23,310 --> 00:03:25,020 If you give it really bad datasets, 97 97 00:03:25,020 --> 00:03:26,820 you're going to have a lot of false positives. 98 98 00:03:26,820 --> 00:03:28,170 If you have really good datasets, 99 99 00:03:28,170 --> 00:03:29,850 you're going to be able to catch a lot more malware 100 100 00:03:29,850 --> 00:03:31,170 and a lot more threats. 101 101 00:03:31,170 --> 00:03:32,310 So keep that in mind. 102 102 00:03:32,310 --> 00:03:34,590 And this is a place where using the right training 103 103 00:03:34,590 --> 00:03:35,520 and the right datasets 104 104 00:03:35,520 --> 00:03:37,820 really does pay off for your machine learning.