APPLIED MACHINELEARNING FOR DATAEXFIL AND OTHER
FUN TOPICS
Matt Wolff, Chief Data Scientist
Brian Wallace, Security Researcher
Xuan Zhao, Data Scientist
Applied Machine Learning  Wolﬀ  Wallace  Zhao

GOALS OF THIS TALK:APPLIED MACHINE LEARNING• Iden5fy suitable problems for ML approaches• Demonstrate by example how to apply ML• Help jumpstart addi5onal research in the Security + ML space

Applied Machine Learning  Wolﬀ  Wallace  Zhao

WHO WE ARE/CYLANCE• Endpoint security company built
around the capabili5es ofar5ﬁcial intelligence• Protec5ng millions of enterprise
endpoints• Founded in 2012, $177 mmraised• Booth #1124

Ma3 Wolﬀ
Chief Data Scien5st
Brian Wallace
Senior Security Researcher
Xuan Zhao
Data Scien5st
Applied Machine Learning  Wolﬀ  Wallace  ZhaoTALKOVERVIEW• Machine Learning Introduc5on• NMAP Clustering• Feature Spaces• Distances• Clustering• Botnet Panel Iden5ﬁca5on• Classiﬁca5on• Feature Reduc5on• Obfusca5ng Data with MarkovChains
Applied Machine Learning  Wolﬀ  Wallace  Zhao

MACHINE LEARNING OVERVIEW• Machine learning techniques are data driven• Available data should be able to solve the problem in a meaningful way• Approaches exist for dealing with raw data, as well as labeled
or annotated data

Applied Machine Learning  Wolﬀ  Wallace  Zhao

MACHINE LEARNING OVERVIEW• Given some data, diﬀerent types of machine learning can be applied• Clustering is useful for ﬁnding similarity across dataset to uncovertrends or other insight• With labeled data, classiﬁca5on can be useful to build predic5ve models

Applied Machine Learning  Wolﬀ  Wallace  Zhao

MACHINE LEARNING OVERVIEW• OYen, raw data has to be transformed in some way to be usedby machine learning algorithms• Typical process is to extract features from data, and turn thosefeatures into vectors• Vectors are then fed into ML algorithms for training or other purposes
Applied Machine Learning  Wolﬀ  Wallace  Zhao

MACHINE LEARNING OVERVIEW• Recommended resources• Scikit-learn.org• Python• Source code for all tools in this talk available on the Cylance public gitrepo• h^ps://github.com/CylanceSPEAR• Should be able to pull talk source and start modifying as needed to suitdata driven problems in your own organiza5on or research group.
Applied Machine Learning  Wolﬀ  Wallace  Zhao

TOOL – NMAP CLUSTERING• NMAP is a popular port scanning tool
• Produces large amount of data per IP address• Scans over large number of IPs can be diﬃcult to make sense of• NMAP Clustering is a tool which clusters (groups) IPs based on
their open ports, services, etc
Applied Machine Learning  Wolﬀ  Wallace  ZhaoFEATURES• Features are informa5ve, discrimina5ve informa5on that can describe asample/observa5on/phenomenon/etc.
• Feature extrac5on is pivotal to the machine learning pipeline• Our features are based on NMAP output• Each port is a feature, each service on each port is a feature,each version of each service on each port is a feature, etc• Script output included in features (including website
5tles, public keys, etc)
Applied Machine Learning  Wolﬀ  Wallace  Zhao

VECTORS• Numerical representa5on of a sample (IP in NMAP case)• Array of values which represent all features from one sample• Vectors can be thought of as points in high dimensional space• Each feature is a dimension, the value of the feature in the vector is theposi5on in that dimension• If we have only two features, it is really easy to visualize
Applied Machine Learning  Wolﬀ  Wallace  Zhao

VECTORS – 2D

Applied Machine Learning  Wolﬀ  Wallace  Zhao

VECTORS – 3D

File

Filename Filesize (kB)
Lengthcalc.exe
8notepad.exe 11malware.exe 11918.528
193.024
193.024Size ofheaders (kB)
63
45
10

Applied Machine Learning  Wolﬀ  Wallace  Zhao

DISTANCES𝑐𝑏• Distance:
Describe the discrepancy between two points• Physical distance between two points:
Pythagorean’s theorem:

a2 + b2 = c2𝑎Applied Machine Learning  Wolﬀ  Wallace  Zhao

File

Filename Length

Filesize (kB)

Size of headers(kb)calc.exe

8918.528

63

notepad.exe

11193.024

45

malware.exe

11193.024

102D3D

Applied Machine Learning  Wolﬀ  Wallace  Zhao

Point 2

DISTANCESManhattan

Mul5ple Distance Metrics –As long as an operation satisfy certain
mathematical criteria, it can be used asa distance metric

Euclidean

Point 1

Applied Machine Learning  Wolﬀ  Wallace  Zhao

CLUSTERING• With a way to measure distance, we can group items by how
close they are, aka clustering• Clusters are dis5nct groups of samples (IP) which have beengrouped together• Clustering is generally unsupervised learning• Diﬀerent algorithms with diﬀerent conﬁgura5ons group thesesamples in diﬀerent ways
Applied Machine Learning  Wolﬀ  Wallace  Zhao

k-Means• Clustering algorithm• User supplies k (des5nated number of clusters)• All samples are assigned to random clusters• Center of each cluster is computed by taking mean (average)of all samples in cluster• Samples are then assigned to the cluster whose center they are closest to• Centers are recomputed, algorithm loops un5l no samples change clusters
Applied Machine Learning  Wolﬀ  Wallace  Zhao

k-Means

Applied Machine Learning  Wolﬀ  Wallace  Zhao

NMAP CLUSTERING – MANUAL/AUTOMATIC• Manual allows you to supply your own clustering parameters• Automa5c tries many diﬀerent methods with theore5cally-foundop5mal parameters and picks what it determines to be the best
• Demo with manual strategy• Demo with automa5c strategy

Applied Machine Learning  Wolﬀ  Wallace  Zhao

NMAP CLUSTERING - INTERACTIVE• Incorporate the User’s decision into theclustering process.
• The Clustering result will be customized
according to customer’s preference in this way• Process (will show with a demo):
1. User decide whether the cluster
needs to be split or not:2. If yes, then split using divisive clustering
3. If no, ﬁnalize this cluster
4. Recursively split un5l users aresa5sﬁed with all the clusters

Y – Split
N – No - Split
YYNFinalized

NFinalized

Applied Machine Learning  Wolﬀ  Wallace  Zhao

NFinalized

TOOL – ID PANEL• Botnet panels (command and control websites) can be diﬃcult to iden5fy• Need previous knowledge of the botnet panels• OYen modiﬁed to avoid detec5on or vanity• Many are based oﬀ others, so dis5nguishing can be diﬃcult• We can train a model to iden5fy if we are looking at a bot panel and which
one it is, with a small number of requests• Minimizing the number of requests to classify improves stealthand rate of classiﬁca5on
Applied Machine Learning  Wolﬀ  Wallace  Zhao

CLASSIFICATION• This is a classiﬁca5on problem• Classiﬁca5on answers “Is it what we are looking for?”• Classiﬁca5on is generally supervised learning• Supervised learning requires training samples to have labels• Classiﬁca5on methods range from simple to highly complex
Applied Machine Learning  Wolﬀ  Wallace  Zhao

ID PANEL FEATURES• Botnet panels are similar to normal websites• Contain various ﬁle types, oYen edited• HTTP response codes + content comparison• Encoding content as features diﬃcult• ssDeep provides a con5nuous value by comparing content
Applied Machine Learning  Wolﬀ  Wallace  Zhao

COLLECTING DATA
• Collec5on of known botnet panels• Request all known paths for all known botnet panel types• Store HTTP status code and ssDeep of content• Collec5on of sites that are not botnet panels needed as well

Applied Machine Learning  Wolﬀ  Wallace  Zhao

DECISION TREES• Decision trees are simple classiﬁers• Splits the dataset one feature at a5me un5l decision is conﬁdent• Results in a tree of queries where
the results produce a decision• Simple to train

Applied Machine Learning  Wolﬀ  Wallace  Zhao

ENSEMBLE OF DECISION TREES• A single decision tree may be over focused on training data
• Can alleviate this problem by building mul5ple Decision Trees for each label• Combining the results allows each Decision Tree to vote• Par5al answers may s5ll be of interest to the user
• Ensembles can obtain be^er predic5ve performance
Pony DT1

Pony DT2

Pony DT3

Dexter DT1

Dexter DT2

Dexter DT3

Zeus DT1

Zeus DT2

Zeus DT3

It’s Pony

Applied Machine Learning  Wolﬀ  Wallace  Zhao

ID PANEL DEMO – COMMAND LINE• Quick way to check if a website directory contains a botnet panel• Easy to batch searching of mul5ple websites/directories• Easy to grep results

Applied Machine Learning  Wolﬀ  Wallace  Zhao

ID PANEL DEMO – CHROME EXTENSION• Every website directory visited is tested• Results are stored in browser• ssDeep ported from C to Javascript• h^ps://github.com/kripken/emscripten• Extension available in Chrome extension store (free, of course)
Applied Machine Learning  Wolﬀ  Wallace  Zhao

TOOL – MARKOV OBFUSCATE• Data exﬁltra5on from a network oYen requires avoiding an outbound ﬁrewall• Deep packet inspec5on looks to block anything undesirable• Easy to encrypt data, but its also easy to drop informa5on that can’t be read
• We can make our data look like something else en5rely

Applied Machine Learning  Wolﬀ  Wallace  Zhao

MARKOV CHAINAABBABABATransiXon Matrix

Training Data

• Simple machine learning method for characterizing sequence data
• Learns the transi5on pa^ern from a state to another based on how likely a state
comes aYer another state in the training data
• We can create sequences with transi5on pa^erns that are learned from thedata it was trained onABA

1 (25%)

3 (75%)

B2 (100%)

0 (0%)B P(ABB) = 0BAAA P(ABA) = 0.75
B P(AAB) = 0.1875
A P(AAA) = 0.0625

Applied Machine Learning  Wolﬀ  Wallace  Zhao

Recommenda,on

POPULAR USE CASES OF
MARKOV CHAINS
Weather Predic,on
Sunny

Rainy

Sunny

0.99990.0001

Rainy

0.9

0.1

0.9

0.95

0.03

0.13

0.1
0.05

Applied Machine Learning  Wolﬀ  Wallace  Zhao

ENCODING DATA WITH A MARKOV CHAIN• Given a transi5on matrix, we can sort items by how likely they are tofollow our current item
• If we choose the 5th most likely item, we can iden5fy it’s the 5th mostlikely with a model trained on the same data
• This encodes the number 5 in the transi5on from our ﬁrst item
to our second item
Applied Machine Learning  Wolﬀ  Wallace  Zhao

MARKOV OBFUSCATE - ENCODING• Train our model with a book
• Observing transi5ons from word to word
• Generate data based on transi5on probabili5es• DemoApplied Machine Learning  Wolﬀ  Wallace  Zhao

MARKOV OBFUSCATE - WRAPPING• Simple to transfer our data through a pipeline that looks
like normal HTTP traﬃc• Looks like a user pos5ng to their blog
• DemoApplied Machine Learning  Wolﬀ  Wallace  Zhao

MARKOV OBFUSCATE – HAVING FUN• Train our models on Taylor SwiY lyrics• Train a Markov Model based on Taylor SwiY songs• Play the generate lyrics through fes5val with tones/beats
learned from songs• First live “Tylance SwiY” concert, demo
Applied Machine Learning  Wolﬀ  Wallace  Zhao

WRAPPING UP• Any problem where there is a signiﬁcant amount of data generated could
beneﬁt from a machine learning approach• Lots of great online resource to help anyone get started• Having labeled or annotated data makes more ML approached viable
compared to unlabeled data

Applied Machine Learning  Wolﬀ  Wallace  ZhaoQUESTIONS?
• Email: machinelearning@cylance.com• Stop by booth #1124• Career opportuni5es: h^ps://www.cylance.com/cylance-careers

Applied Machine Learning  Wolﬀ  Wallace  Zhao