Deep Neural Networks for Hackers: Methods, Applications, and Open Source Tools. Joshua Saxe, Chief Data Scientist, Sophos

Transcription

1 Deep Neural Networks for Hackers: Methods, Applications, and Open Source Tools Joshua Saxe, Chief Data Scientist, Sophos

2 About your speaker

3 Your speaker s Sophos You

4 Security Data Science Machine learning Data Visualization Databases, cloud engineering My focus today Deep learning (a.k.a. deep neural networks) other machine learning approaches

5 This is deep learning: real time computer vision

6 This is deep learning: computer vision + reinforcement learning

7 This is deep learning: new content generation

8 This is deep learning: detection of previously unseen URLs Neural network suspicious score, ranges from 0-1

9 The deep learning revolution in numbers (malware detection) Signatures + neural network Deep neural net (no updates!) Signatures only (daily updates)

10 The deep learning revolution in numbers Object detection in images Speech to text transcription

11 At Sophos we ve come to use deep learning everywhere HTML Android File paths / registry keys Windows PE

12 How deep learning and machine learning change security Old world Detection rules written manually Daily updates to blacklists and signatures Anti-virus data takes hundreds of megabytes Sub-par ability to detect new threats New world Detection models trained automatically Models need updating every month or two Models take about 10 megabytes on disk Breakthrough in ability to detect new threats

13 When neural networks go wrong: Neural network generated recipe

14 When neural networks go wrong: Neural network generated recipe

15 Sometimes deep learning is not the answer

16 How does machine learning based detection work? File size

17 File compression Deep learning uses non-linear decision boundaries 2d decision boundary in 3d space

18 File compression Real decision boundaries live in high dimensional space 2d decision boundary in 3d space 6d space would have a 5d decision boundary! Memory allocation

19 File compression Neural networks as machines for drawing decision boundaries File compression File size File size

20 File compression Automatic neuron weight tuning (a.k.a. learning) Behind the decision boundary learning process File compression File size File size

21 How neurons work as simple computational units

22 Behind the decision boundary learning process Bad weight settings (red) Current weights Weight 2 Weight 2 Good weight settings (green) Weight 1

23 Behind the decision boundary learning process Bad weight settings (red) Weight 2 Good weights Good weight settings (green) Weight 1

24 Behind the decision boundary learning process Bad weight settings (red) Weight 2 Weight 2 Good weight settings (green) Weight 1

25 What neural networks can see when learning Bad weight settings (red) Weight 2 Weight 2 Weight 1

26 Learning means walking downhill in the weight space Behind the decision boundary learning process File compression File size Weight 1

27 Neural networks: Bringing it all together Decision boundaries 6d space would have a 5d decision boundary! Memory allocation Learning from data Weight 2 Weight 1

28 Kitten break

29 Convolutional neurons No convolutions # lines in image brightness of image contrast in image # curves in image # white blobs in image Convolutions: automatic feature extraction

30 Convolutional neural network architecture

31 How our URL neural network works Output: malicious or benign? Output: building or no building?

32 How our neural network learns to think about URL characters Digits

33 Behind the scenes, URL convolutional neurons This Then this Then this Then this Then this Neural network suspicious score, ranges from 0-1

34 How our HTML neural network works

35 When neural networks go wrong: meme generation

36 When neural networks go wrong: meme generation

37

38 Key deep learning technologies Supporting Python libraries Deep learning stack

39 Deep learning hardware: fast GPUs and lots of memory

40 Making neural network rapid prototyping easy Architecture of our URL detector Keras code for our URL detector

41 Becoming a security data scientist

42 Qualities you need Basic intelligence (you all have it) Open-mindedness Boundless curiosity about data Obsession with results Skepticism of results

43 Collaborating with non-data scientist security researchers is key

44 Where to go from here

45