This collection of presentations were given at FloCon 2019, an annual event where attendees discuss the analysis of large volumes of traffic and showcase the next generation of flow-based analysis techniques.
Improved Hunt Seeding with Specfic Anomaly ScoringJanuary 2019
Author(s): Brenden Bishop (Columbus Collaboratory)
In this presentation, the attendees were presented with a flexible, open source tool for non-parametrically modeling multivariate densities of network logs.
Using Triangulation to Evaluate Machine Learning ModelsJanuary 2019
Author(s): Andrew Fast, PhD (CounterFlow AI)
In this presentation, Dr. Andrew Fast presents a series of questions and data queries that can be used to determine the parameters of effectiveness for a machine learning model.
Cybersecurity Data Science: Best Practices from the FieldJanuary 2019
Author(s): Scott Mongeau (SAS)
In this presentation, the author seeks to take a step back from methodological insights and case studies to ask larger questions concerning the status of cybersecurity data science as an emerging profession.
The Power of Cyber Threat IntelligenceJanuary 2019
Author(s): Eboni Thamavong (X8, Full Spectrum Engagement)
In this presentation, the author discusses how to anticipate the right questions and convey the right information to executives through case studies that highlight the power of what cyber threat intelligence can do to drive executive decision making.
The Generation and Use of TLS FingerprintsJanuary 2019
Author(s): Blake Anderson (Cisco Systems, Inc.), David McGrew (Cisco Systems, Inc.), Keith Schomburg (Cisco Systems, Inc.)
In this presentation, the authors describe a TLS fingerprinting system and discusses the common pitfalls when using this type of information and analyzes techniques that make effective use of our newly open-sourced TLS fingerprint database.
Monitoring Massive Network Traffic using Bayesian InferenceJanuary 2019
Author(s): David Rodriguez (Cisco Systems, Inc.)
In this presentation, the author discusses methods for performing large scale Bayesian inference on DNS logs aggregated into count data, representing the number of requests from tens of millions of stub IPs made to hundreds of millions of domains.
Using Generative Adversarial Networks to Improve Phishing Domain ClassifiersJanuary 2019
Author(s): Jen Burns (The MITRE Corporation), Emily Heath (Mitre)
In this presentation, the authors discuss the use of generative adversarial networks (GANs) to construct synthetic phishing domains as potential evasion attacks, and test the value of including these domains in a machine learning classifier.
Harvesting Logs for Enhanced InvestigationsJanuary 2019
Author(s): David Gainey (Defense Information Systems Agency)
In this talk, the author discusses the type of information that should be continuously collected and kept on-hand for investigative value in the case of a network compromise, and he addresses the value of such artifacts in an investigation.
Network Telescopes Revisited: From Loads of Unwanted Traffic to Threat IntelligenceJanuary 2019
Author(s): Piotr Bazydlo (Research and Academic Computer Network (NASK, Poland)), Adrian Korczak (Research and Academic Computer Network (NASK, Poland), Pawel Pawlinski (Research and Academic Computer Network (NASK, Poland))
This presentation introduces a comprehensive system developed to analyze malicious traffic on a large scale and produce actionable results in close to real time.
Time-Based Correlation of Malicious Events and Their ConnectionsJanuary 2019
Author(s): Steve Henderson, Brittany Nicholls (Enlighten IT Consulting), Brian Ehmann (Enlighten IT Consulting)
In this presentation, the authors discuss how to automate the use of statistics to help link events and connections in a timeline during an incident or forensic investigation.
InSight2: IRNC Advanced Measurements and Instrumentation (AMI)January 2019
Author(s): Angel Kodituwakku (The University of Tennessee Knoxville), Dr. Jens Gregor (The University of Tennessee Knoxville), Buseung Cho (KISTI), Carter Bullard (QuSient LLC)
In this presentation, the authors discuss InSight2, an open platform, intended to monitor and facilitate the development of network analytics for these large-scale networks.
Detecting Automatic FlowsJanuary 2019
Author(s): Jeffrey Dean (United States Air Force)
In this presentation, Jeffrey Dean, PhD., discusses specific Netflow-derived features that can be used to discriminate between flows generated by user actions and those generated automatically by applications or systems.
Quantum Approach to Inverse Malware Eradication January 2019
Author(s): Daniel Medina (Glasswall Solutions Inc.), Matt Shabat (Glasswall Solutions Inc.)
The goal of this presentation is to inform people that using a 'pass only known good' methodolgy through a quantum approach simplifies the solution and the future of information security will benefit from an inverted approach to security.