ZeekWeek 2022 - CatchM3ifuKan - Detecting Command-and-Control Techniques Up and Down the Stack
By Matti Bispham, NCC Group | Ruud van Luijk, Fox-IT | Joost Jansen, Fox-IT
In this talk we hypothesize that to evade detection advanced attackers utilize the entirety of the networking stack. As a Data Science research team we introduce the paradigm of Online/Incremental Machine Learning to aid with timely detection. Based on research we highlight areas of malicious command-and-control that have a high potential for anomaly-based / outlier detection. Some real world examples from recent investigations are presented. The talk also provides discussion into the benefits and limitations of expert systems in integrating Machine Learning and Statistical techniques into effective detection logic on Zeek data.
Speaker Bios:
Matti is a Senior Data Scientist at NCC Group. He enjoys researching Applied Mathematics and identifying how that can be helpful to challenges in offensive and defensive cyber security, as well as wider societal challenges.
Ruud is a Senior Data Scientist at Fox-IT, part of NCC Group. He uses his experience with Machine Learning and statistics to create detection capabilities where signatures are not sufficient and is part of the team that provides real-time ML detection on network traffic for Fox-IT.
Joost is a Data Scientist at Fox-IT, part of NCC Group. Joost enjoys forensic analysis, CTFs and winning at table football.