SecuML: Machine Learning for Computer Security

1. SecuML: Machine Learning for Computer Security Experts Anaël Beaugnon anael.beaugnon@ssi.gouv.fr Laboratoire Exploration et recherche en Détection (LED) Paris Open Source Summit - 06/12/2018
2. Computer Security Detection Systems Communications · · · Detection System Security administrator Detection methods Security operators Alerts Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 2/8
3. Computer Security Detection Systems Communications · · · Detection System Security administrator Detection methods Security operators Alerts Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 2/8
4. Building Machine Learning Detection Models The Whole Machine Learning Pipeline PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF PDF -3.5 1.3 0 2.4 -3 0.5 -1.4 0 3.4 -1 0.3 2.3 -0.5 1.1 . . . -1.3 0 3.2 1.3 -0.7 0 -2.9 -3.5 1.3 0 2.4 -3 0.5 -1.4 0 3.4 -1 0.3 2.3 -0.5 1.1 . . . -1.3 0 3.2 1.3 -0.7 0 -2.9 ok 1 2 3 4 ko 1 Feature extraction 2 Annotation 3 Which model class ? 4 Evaluation PhD Thesis A. Beaugnon, Expert-in-the-Loop Supervised Learning for Computer Security Detection Systems Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 3/8
5. Building Machine Learning Detection Models Challenges Non-machine learning experts Generic solution (not limited to texts or images) Graphical user interface (visualization and interaction) Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 4/8
6. SecuML: Beyound scikit-learn scikit-learn Classification, clustering, dimension reduction, etc. Scaling, grid search, cross validation, etc. SecuML Hide some of the machine learning machinery GUI to visualize and interact with ML models Work on any data type Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 5/8
7. DIADEM (DIAgnosis of DEtection Models) Training and Evaluation Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 6/8
8. In-situ annotations with ILAB (Interactive LABeling) Reducing the annotation workload Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 7/8
9. SecuML: Machine Learning for Computer Security Experts Only for Computer Security experts ? Work on any data type Visualization and diagnosis of machine learning models Data annotation with a reduced workload Open source implementation: https://github.com/ANSSI-FR/SecuML Online documentation: https://anssi-fr.github.io/SecuML/ Anaël Beaugnon SecuML: Machine Learning for Computer Security Experts 8/8