Sqrrl Blog

Mar 9, 2017 8:00:00 AM

The Nuts and Bolts of Detecting DNS Tunneling

DNS-based attacks have been commonly used since the early 2000’s, but over 40% of firms still fall prey to DNS tunneling attacks. Tunneling attacks originate from uncommon vectors, so traditional automated tools like SIEMs have difficulty detecting them, but they also must be found in massive sets of DNS data, so hunting for tunneling manually can be challenging as well. So, how can we use more advanced analytic techniques to isolate these adversary behaviors? In a different publication we covered Domain Generation Algorithms and what the best sources are for detecting them. In this piece, we’ll be covering how best to sniff out malicious DNS tunneling on your network.

Read More

Topics: Machine Learning, UEBA, DNS

Jun 16, 2016 4:47:34 PM

An Introduction to Machine Learning for Cybersecurity and Threat Hunting

At BSides Boston 2016, Sqrrl’s Lead Security Technologist, David Bianco, and Director of Data Science, Chris McCubbin, gave a presentation about the importance of machine learning in the field of Cyber Threat Hunting. In this interview, we talk with them about how it relates to tools like UEBA, and where they see it taking the world of cybersecurity in the future. When used effectively, machine learning provides more accurate, effective insight into threats of all kinds. They predict that machine learning will soon take hold as a major influencing factor on organizations’ Security Operations Center workflows. In addition to their presentation, David and Chris also provide code for anyone interested in taking a hands-on approach to machine learning.

What is machine learning?

Chris: Very basically, machine learning is the capability of a deployed algorithm to adapt to the data that’s being input into it. A normal algorithm, for example, will run on a particular set of data and give you a result, and if you run it on the same set of data again, it will give you the same result. Machine learning has an adaptive component where if you run it on a piece of data it will do something and then change its behavior based on that data. So, even if you ran it on the same data twice, it might give you a different result because it’s adapting. That’s a very broad definition.

Read More

Topics: Threat Hunting, Threat Detection, Cyber Threat Hunting, Machine Learning, UEBA

Feb 17, 2016 12:51:00 PM

Gravitational Waves Collide with Cybersecurity: Using Machine Learning Inspired by Astrophysics

By Ruslan Vaulin, senior data scientist at Sqrrl, member of the LIGO Scientific Collaboration

What do searching for signals from merging black holes some billion light years away and searching for cyber adversaries operating on your network have in common? More than you might have guessed...

But let’s start from the beginning. Last week (February 11, 2016) National Science Foundation and LIGO Scientific Collaboration announced the first confirmed detection of gravitational-wave signal from collision of two black holes. The collision happened more than a billion light years, away producing an outburst of gravitational-wave energy equivalent to the light of all stars in our galaxy. While very powerful, such radiation is extremely difficult to detect due to a very weak interaction between gravity and ordinary matter. It truly requires a Jedi's power to sense such disturbances in the force!

Read More

Topics: Big data security analytics, LIGO, Data Science, Machine Learning