Meet Apache Spot, a new open source project for cybersecurity by Katherine Noyes.
From the post:
Hard on the heels of the discovery of the largest known data breach in history, Cloudera and Intel on Wednesday announced that they’ve donated a new open source project to the Apache Software Foundation with a focus on using big data analytics and machine learning for cybersecurity.
Originally created by Intel and launched as the Open Network Insight (ONI) project in February, the effort is now called Apache Spot and has been accepted into the ASF Incubator.
“The idea is, let’s create a common data model that any application developer can take advantage of to bring new analytic capabilities to bear on cybersecurity problems,” Mike Olson, Cloudera co-founder and chief strategy officer, told an audience at the Strata+Hadoop World show in New York. “This is a big deal, and could have a huge impact around the world.”
…
Essentially, it uses machine learning as a filter to separate bad traffic from benign and to characterize network traffic behavior. It also uses a process including context enrichment, noise filtering, whitelisting and heuristics to produce a shortlist of most likely security threats.
…
Given the long tail for patch application, Prioritizing Patch Management Critical to Security, which reads in part:
…
Patch management – two words that are vital to cybersecurity, but that rarely generate enough attention.That lack of attention can cost. Recent stats from the Verizon Data Breach report showed that many of the most exploited vulnerabilities in 2014 were nearly a decade old, and some were even more ancient than that. Additional numbers from the NTT Group 2015 Global Threat Intelligence Report revealed that 76 percent of vulnerabilities they observed on enterprise networks in 2014 were two years old or more.
…
Apache Spot is not an immediate threat to hacking success, but that’s no reason to delay sharpening your malware skills.
Beyond making malware seem benign, have you considered making normal application traffic seem rogue?
When security becomes “too burdensome,” uninformed decision makers may do more damage than hackers.
I know machine learning has improved but I find the use case:
at the very best, implausible. 😉
Thoughts on a test environment to mimic target networks?
Enjoy!