Overview
Threat Detection is the art of identifying attacks on a computer. While there are a large variety of attacks, most of them fit into one of four categories -
-
Probe
-
Denial of Service (DoS)
-
User to Root
-
Remote to User
Apache Metron
Apache Metron is a cybersecurity application framework which provides the ability to ingest, process and store diverse security data feeds at a scale level in order to detect cyber anomalies and enable organizations to rapidly take action against them.
Apache Spot
Apache Spot is a cybersecurity project, aimed to bring advanced analytics to all IT Telemetry data on an open, scalable platform. Apache Spot expedites the threat detection, investigation, and remediation via machine learning and consolidates all enterprise security data into a comprehensive IT telemetry hub based on open data models.
Threat Detection Using Deep Learning
A multi-layered deep learning based system is very robust, scalable and adaptable. All the identified incidents & patterns are denoted by a risk score, to help investigate the breach, control data loss and take precautionary actions for future.
Threat Detection Using Machine Learning
A Machine Learning based Threat Detection system automates the process of extracting insights from file samples through better generalization at identifying unknown variations. It also helps in reducing human analysis time.
Problem Statement
-
To perform Real-Time Threat Intelligence on trillions of messages per year.
-
Storing and Processing the unstructured security data.
-
Combining Machine Learning and Predictive Analytics to perform Real-Time Threat Analytics.
Solution Offered
We offered the solution for Threat Analytics and Intelligence by Automating the process of Threat Detection and Analysis. Following steps are performed to Automate the process -
- Network Dataset
- Pre-Processing of Data
- Feature Extraction
- Reduce Data Amount
- Improve Accuracy
- Avoid Overfitting
- Training and Testing of Data Using Classification Models
- Decision Tree
- Random Forest
- Naive Bayes
- KNN
- Result Analysis