A use case in Finance Sector
LEVERAGING BIG DATA
ANALYTICS TO REDUCE
SECURITY INCIDENTS
I
NITIAL
S
CENARIO
•
Stolen data/credentials
•
Malware / Phishing
•
Denial of Service
•
APTs
•
Reputation damage
•
Discredit campaign
•
Mobilize demonstrations
•
Employee harassment
•
Money theft
•
Vandalism
•
Employee harassment
•
Black market cards
•
Transactions fraud
•
Money laundering
IT Security Incidents
Physical Incidents
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 3
M
AIN PROJECT GOALS
Scale beyond the fish tanks
Get more out of each byte
Machine Learning
Data Lake
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
A
RCHITECTURE
EVENTS
DATA
DATA
DATA
EVENTS
CEP CORRELATION
ENGINE
BIG DATA
REPOSITORY
COLLECTION +
NORMALIZATION
REALTIME
ANALYSIS
MESSAGE BUS
Alerts Handling
Reporting
STORAGE
T
HE DATA LAKE
IT SECURITY
INCIDENTS
PHYSICAL
INCIDENTS
E-MONEY
INCIDENTS
MALWARE
FEEDS
SOCIAL
NETWORKS
DATA NORMALIZATION
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
SOCIAL NETWORKS
●
e-
F
EELING
C
ONCEPT
“Calculate
people’s feeling
about the Organization’s brand”
!
Correlation Engine
Intelligence
Engine
Big Data
Repository
e-Feeling
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
ML
●
TECHNIQUES APPLIED
To
Forecast an event
occurrence based on past events
Ex: “Number of Attacks to Organization’s website in the next 5 days”
FORECASTING
To
Classify a new event
based on a previous events classification
Ex: “Classify a transaction as FRAUD / NO FRAUD”
CLASSIFICATIONS
Mine data
to find relations in events occurred in same time interval
Ex: “Every time a netscan is detected, a SQLi is seen 80% of times”
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 9
Driven by
Data Scientists &
Validated by Organization
M
ACHINE LEARNING OPERATIONS
BIG DATA
REPOSITORY
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
ML
IN ACTION
●
PATTERN DISCOVERY
Discover patterns
among different areas
Example:
“When
e-Feeling
for 3 days,
#CyberAttacks
90% of the times”
Implement the patterns
to prevent incidents
“
IF
e-Feeling
for 2 days
THEN
alert of potential
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 11
ML
IN ACTION
●
FORECASTING
Forecast occurrence of an event
based on
modelled past ones
Example:
Tomorrow’s number of attacks to Home banking
Implement a rule
in the Correlation Engine anticipating
the possible incidents
“
IF
trend of
#HomeBanking attacks
in the next days,
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
ML
IN ACTION
●
CLASSIFYING
Classify new events
based on models created after
analyzing previous ones
Example:
•
Security Risk Scoring
of a Home Banking login
Feed the results
to other applications to provide them
with useful info before taking decisions
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 13
… The Other Ones
The Good Ones…
ML
●
RESULTS SO FAR
Improvement
of Cyberattacks readiness
Better anticipation
on people demonstrations calls
Decrease of fraud
on ATMs
Discover new data relationships
between areas
Numerically good results don’t always mean
interesting results for the Organization
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 15
ML
&
A
DAPTATION
vs
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
ML
&
K
NOWLEDGE
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 17
M
ULTI-AREA
E
NGAGEMENT
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 19
P
ATIENCE IS REQUIRED…
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE
ML
HOUSEKEEPING
LEVERAGING BIG DATA ANALYTICS TO REDUCE SECURITY INCIDEN TS ● A FINANC E SECTOR USE CASE 21
N
EXT STEPS …
Evaluating new technologies to
horizontally-scale in memory the Machine Learning
process
Thanks for your time!
Josep Román
Senior Manager @ Indra
jroman@indra.es
