Evaluation of Transformer Neural Network Modeling Methodologies applied to Behavior Malware Traces — This article evaluates various Transformer Neural Network (AI model powering GPT) engineering methodologies applied to machine data — malware behavioral logs from the Speakeasy emulator. Data used in these experiments have been freely available since released as part of this publication on hybrid malware analysis [Trizna], with archives downloadable here…

This article is a how-to guide with code samples for security professionals and data scientists who wish to apply machine learning techniques for cyber-security needs. — Introduction Applicability of Machine Learning (ML) algorithms — in the industry, tutorials, and courses — is heavily biased towards building the ML models themselves. From our point of view, however, the data preprocessing step (i.e., …

Anomaly detection engineering based on power law distribution in enterprise security telemetry — This article will focus on the “data-centric security” paradigm — utilization of statistical knowledge for cyber-security needs. This threat-hunting approach produces the same results regardless of deployment and environmental characteristics. We will define baseline activity based on the statistical pattern of Zipf’s law (more generally known as “power law”), using…

Abstract Control of compromised machines within the target network happens through specifically designed Command & Control (C&C, C2) infrastructure. This article describes the rationale behind C2 design decisions and provides a step-by-step setup of the C2 redirector. The report may be valuable for defensive analysts as insight in operations of adversary…

Abstract This article describes utilizing Windows Sysmon Events for behavioral security analytics. The decision heuristic is based on the Recurrent Neural Network (RNN), which considers event sequence. This work aims to provide a reader with a necessary epistemic background on techniques from Data Science or Information Security domains and to show…

Introduction Recently, we performed analysis on high volume of Windows Event Logs in XML format. Provided file was truncated, i.e. with incorrect XML structure. Standard Python xml library does not provide any options in order to deal with such a tagging problem. …

Disclaimer An important value that moves cyber security boundaries forward is the magnificent work done by researchers worldwide. Luckily for everyone in this industry, often this work is shared freely and publicly. One of the research directions, offensive tradecraft, provides possibilities for security engineers and analysts to improve their defensive posture…