Explore advanced threat detection techniques in this BSidesLV conference talk on transfer learning for analyst-sourcing behavioral classification. Delve into the challenges of AI in InfoSec, active learning strategies, and the importance of label acquisition. Discover three key objectives for transfer learning, including sharing labeled data and handling negative transfer. Examine a practical experiment on detecting phishing domains, comparing transfer learning results with traditional blacklists. Learn how organizations can collaborate by sharing labels to improve detection capabilities. Gain insights into potential new features for enhancing phishing detection and consider future applications in other use cases.
Transfer Learning - Analyst-Sourcing Behavioral Classification
Overview
Syllabus
Intro
About us: the data science guy
Problem: advanced attacks
Detection of different APT stages
Trained Al pinpoints attacks
Challenges of Al in InfoSec
My life these two last years
Active learning: label acquisition is key!
Three objectives for transfer learning
Sharing labeled data
Handling negative transfer
Delivery via phishing domains
A quick experiment
Dataset description
Training a model
Active learning results
Organizations 1 and 2 sharing labels
Organization 3 joins at 5th month
Detecting phishing domains: TL vs. Blacklists
Improve phishing detection Ideas for new features?
Next steps: address a new use case
Taught by
BSidesLV
