Malice through the looking glass
description
Transcript of Malice through the looking glass
Malice Through the Looking Glass
Behavior Analysis for the Next Decade
Jeff Debrosse
“It is better to be roughly right than precisely wrong.”
•John Maynard Keynes
ANALYZE THIS…
Industry core focus
• code analysis
• Parse textual content
ANALYZE THAT…
Add social engineering analysis to threat analysis
• Examine the behavior of the victim (underlying causes)
• Treat the disease as well as the symptom(s)!
TRADITIONAL SECURITY DILEMMA
Security Convenience
PSYCHOLOGY AND DECEPTION
“Psychological manipulation of an individual or set of individuals to produce a desired effect on their behavior.“
TODAY’S AV VENDOR GOAL
To increase the security of our customers
• Heuristic Technology
• Cloud-based Solutions
• Others
Today we mostly look for:
• Known bad objects (blacklisting)
• Known good objects (whitelisting, change detection)
THE PSYCHOLOGY OF DETECTION
What does behavior analysis have to do with social engineering?
• Fake AV sells
• Manual analysis = large overhead (and it’s getting larger)
• User behavior: another security layer?
THE PSYCHOLOGY OF DETECTION
JDLR: Cop Talk for “Just Don’t Look Right”
At this point, we may identify software as:
• Already classified
• Resembles badware (JDLR)
• Shares characteristics of badware
• Something which may be good or bad, but has proscribed characteristics
THE HUMAN ELEMENT
“No matter how low an opinion you have of your users, they will
find a way to disappoint you”
• Stamos’ Law (or his corollary to Murphy’s Law)
• Stamos, BH 2009
PROBABILITY AND EMAIL
Bayesian spam filtering
• Counts number of incorrect classifications.
• Low computational overhead
• Very fast machine learning
BAYESIAN ANALYSIS IN ACTION
the phrase “male enhancement” is detected in the body of the email (85% probability of the message being spam)
the subject contains the phrase “real prescription meds” (95% probability)
the body also contains the word (FREE) in all caps (98% probability)
the sender’s email address and sending server are different –99.9% probability)
PROBABILITY AND PEOPLE
Can we predict human behavior (with any accuracy)?
Behavioral targeting does this today!
GET YOUR GAME (THEORY) ON
Game theory attempts to predict behavior such as:
• the interaction between two people
• movements of financial markets
• modern-day warfare
THE PRISONER’S DILEMMA (OR PREDICTABLE RATIONALITY)
S1
confess don’t
S2
confess 10,10 0,20
don’t 20,0 1,1
CONCLUSION
Feedback
Ethics
Optimized by…
• Cloud?
• Aggregation?
• Behavioral Data?Have we reached the
industry’s limits?
QUESTIONS?