Bobby Filar @filar Twitter profile | Pikagi

Pikagi

Bobby Filar

@filar

2,099

Followers

948

Following

316

Media

6,271

Statuses

dad. security machine learning @sublime_sec fmr: @elastic , @endgameinc

MPLS

https://t.co/YCdsZzGmIs

Joined July 2008

Don't wanna be here? Send us removal request.

Pinned Tweet

@filar

Bobby Filar

4 years

New @elastic blog post "Discovering anomalous patterns based on parent-child process relationships" covers a lot of material from my ProblemChild @CamlisOrg talk.

Tweet card media

Detecting attackers using anomalous patterns in machine learning

Attackers using “living off the land” techniques can be difficult to identify. Detecting post-compromise anomalous patterns based on parent-child process relationships helps detect adversaries that...

8

83

239

Last Seen Profiles

@bokeplokalmalam

@horizon523852

@bir_carmo

@oriveneca

@iitbombay

@lmkr137494

@PetraWallet

@fec_iitg

@MoveBit_

@god45444

@twink_loverr

@arnulfoveloso3

@Ratt_Basturd

@Mark_A_DeKoning

@Lewysko

@PolishJabroni91

@Lp0stAlt

@rayisarang

@QamarulQashroff

@Taryeves

@SAINTDELIC

@RachelPrzybylM

@MixkenMonaka

@Soli_iniigo

@759x7

@OdehMaen

@whtlilium

@NyxDerg

@RechiruNSFW

@RebecccaJuicy

@Patino_____

@Reiy69

@ManojYadav1515

@Prettytootsy1

@RakshanVJ

@NC010203

@filar

Bobby Filar

6 years

Two Deep Learning NLP books coming this year: Deep Learning with Text by @honnibal & @skipgram Natural Language Processing with PyTorch @deliprao & @GokuMohandas

Tweet card media

Natural Language Processing with PyTorch

Natural Language Processing (NLP) provides boundless opportunities for solving problems in artificial intelligence, making products such as Amazon Alexa and Google Translate possible. If you’re a...

www.oreilly.com

3

65

206

@filar

Bobby Filar

4 years

Excited to see @elastic open up its detection rules repo. Blog post by @rw_access does a great job detailing how to get rules into your detection engine and how best to contribute to the community.

Tweet card media

Elastic Security opens public detection rules repo

Elastic Security has opened its detection rules repository to the world. We will develop rules in the open alongside the community, and we’re welcoming your community-driven detections. This is an...

2

59

157

@filar

Bobby Filar

4 years

Finally releasing MalwareRL, an OpenAI gym for Ember and MalConv malware classifiers. This builds on the RL research @drhyrum @mrphilroth and I did on malware evasions. There are new binary modifications and a baseline (random) agent to get you started.

Tweet card media

GitHub - bfilar/malware_rl: Malware Bypass Research using Reinforcement Learning

Malware Bypass Research using Reinforcement Learning - bfilar/malware_rl

2

43

105

@filar

Bobby Filar

6 years

Me avoiding feature tickets in JIRA during that final sprint before testing...

3

9

96

@filar

Bobby Filar

4 years

@newbury_eric @passantino @neontaster You're right these can definitely can be used as an alternative, but they are still not ventilators. Saying that you sent ventilators when you actually sent CPAP machines is why articles like this get written.

4

1

80

@filar

Bobby Filar

5 years

About to give my talk at #VB2019 on using ML and graph theory to identify malicious process chains in event data. Slides here:

3

36

87

@filar

Bobby Filar

3 years

I am beyond excited about the SecML team's work here @elastic . This post shows how our team uses transforms to identify beaconing malware. We hope this post encourages security researchers to prototype new statistical models to detect bad in their data!

Tweet card media

Identifying beaconing malware using Elastic — Elastic Security Labs

In this blog, we walk users through identifying beaconing malware in their environment using our beaconing identification framework.

0

18

85

@filar

Bobby Filar

6 years

@SwiftOnSecurity @HuntOperator - Where do they get training data? - How do they generate labels? - What are the performance metric? - How often are models retrained? (Do they degrade over time?) - How well does it generalize to previously unobserved samples/events?

3

2

79

@filar

Bobby Filar

5 years

Updated slides from my @CamlisOrg talk on using ML/Graph analysis to discover malicious parent-child process communities aka ProblemChild.

Tweet card media

ProblemChild_Camlis_FINAL

ProblemChild: Discovering anomalous patterns based on parent-child process relationships Bobby Filar Team Lead, Sec Data Sci @filar David French Security Researcher @threatpunter Hyrum Anderson Tech...

docs.google.com

4

24

72

@filar

Bobby Filar

6 years

"Machine Learning in Cyber-Security - Problems, Challenges and Data Sets" by researchers @shodanhq and @PaloAltoNtwks Really nice set of topics/datasets

Tweet card media

Machine Learning in Cyber-Security - Problems, Challenges and Data Sets

We present cyber-security problems of high importance. We show that in order to solve these cyber-security problems, one must cope with certain machine learning challenges. We provide novel data...

0

33

70

@filar

Bobby Filar

6 years

Ember: An Open Source Classifier And Dataset by @EndgameInc . Huge step forward for reproducibility in malware classification research. Thanks @mrphilroth and @drhyrum for your hard work! Github: Blog:

Tweet card media

GitHub - elastic/ember: Elastic Malware Benchmark for Empowering Researchers

Elastic Malware Benchmark for Empowering Researchers - elastic/ember

1

38

69

@filar

Bobby Filar

7 years

Two ML/infosec papers on identifying malicious strings: Predicting Domain Generation Algorithms with LSTMs by @jswoodbridge et al. eXpose: A Char-Level CNNs For Detecting Malicious URLs, Paths and Reg Keys by @joshua_saxe et al.

1

39

68

@filar

Bobby Filar

5 years

Just came across @struppigel 's "Malware Analysis For Hedgehogs" channel. His breakdown of the Basic Structure of PE Files is super helpful for Data Scientists who may be working on malware classification. Very simple, intuitive explanations.

2

20

66

@filar

Bobby Filar

7 years

A fantastic book is now a great online resource too! "Data Science at the Command Line" by @jeroenhjanssens is now freely available at:

0

17

59

@filar

Bobby Filar

2 years

I am excited to start my new role as the Head of Data Science at @sublime_sec . I look forward to showing how we can combine ML & custom rule logic to build a genuinely novel, adaptable, and transparent email security experience.

4

4

60

@filar

Bobby Filar

7 years

Updated "Learning to Evade Static PE Machine Learning Malware Models via Reinforcement Learning" paper by @drhyrum , @mrphilroth , @UdacityDave , Kharkar, and myself!

Tweet card media

Learning to Evade Static PE Machine Learning Malware Models via...

Machine learning is a popular approach to signatureless malware detection because it can generalize to never-before-seen malware families and polymorphic strains. This has resulted in its...

4

34

59

@filar

Bobby Filar

5 years

@caleb_fenton @JulesBaderrrr @pantalea0 @j_opdenakker i haven't seen this post in ages, but it still cracks me up

0

1

55

@filar

Bobby Filar

2 years

After 7 years, today is my last day at @elastic . I am incredibly lucky to have worked with such a talented group! I want to thank @mark_dufresne and @snowboardvstree for their patience, mentorship, and friendship. @SamanthaZeitlin for her outstanding leadership

8

0

54

@filar

Bobby Filar

6 years

More evidence that I work w/ some brilliant folks @EndgameInc . 2 #BHUSA Talks accepted! @malwareunicorn & @rseymour - FINDING XORI: MALWARE ANALYSIS TRIAGE WITH AUTOMATED DISASSEMBLY @dez_ & @gabriellandau - KERNEL MODE THREATS AND PRACTICAL DEFENSES

0

16

55

@filar

Bobby Filar

7 years

Two books coming out this year on Machine Learning in Infosec by some real smart folks. "Machine Learning and Security" by @cchio & Freeman (Facebook) "Malware Data Science" by @joshua_saxe & @hillarymsanders

Tweet card media

Malware Data Science

Malware Data Science explains how to identify, analyze, and classify large-scale malware using machine learning and data visualization.

0

21

53

@filar

Bobby Filar

6 years

PassGAN: A Deep Learning Approach for Password Guessing. Great breakdown of GAN architecture and how it works w/ text datasets. Paper: Code:

Tweet media one

0

24

54

@filar

Bobby Filar

6 years

RAPTOR: Ransomware Attack PredicTOR DGA features coupled w/ time series methods used to build model to identify potentially malicious domains while watching new DNS registrations. Interesting approach, susceptible to bypass by sophisticated adversaries.

Tweet card media

RAPTOR: Ransomware Attack PredicTOR

Ransomware, a type of malicious software that encrypts a victim's files and only releases the cryptographic key once a ransom is paid, has emerged as a potentially devastating class of cybercrimes...

1

27

51

@filar

Bobby Filar

3 years

Machine learning proverb

Tweet media one

0

9

53

@filar

Bobby Filar

7 years

2 great posts on WCry by @EndgameInc researchers. Covers both analysis and prevention.

2

26

45

@filar

Bobby Filar

3 years

In the post on "Linux malware protection in @elastic Security," @DanielStepanic and @gradientjanitor show how we leverage ML to generate YARA signatures for detecting Linux malware. Code included below. Post: Repo:

Tweet media one

0

12

47

@filar

Bobby Filar

3 years

No @CamlisOrg submission for me this year. Spending a lot of time with my new reinforcement learning project…

Tweet media one

0

1

47

@filar

Bobby Filar

3 years

I really like this graphic the folks #ThreatHuntingSummit made for @randomuserid talk on "Practical Threat Hunting w/ ML." It captures how we can effectively leverage (un)supervised ML w/o drowning users in FP-prone signals.

Tweet media one

0

14

47

@filar

Bobby Filar

7 years

Infosec Data Scientists there is a new dataset to start tinkering with courtesy of @Andrew___Morris Greynoise API Python Wrapper

Tweet card media

GitHub - bfilar/greynoise: Query GreyNoise Intelligence API in Python

Query GreyNoise Intelligence API in Python. Contribute to bfilar/greynoise development by creating an account on GitHub.

@Andrew___Morris

Andrew Morris

@Andrew___Morris

7 years

My dude @filar coming in hot with the library and ipython notebook analysis of Grey Noise data approximately 0.34125 seconds after it was released

Tweet media one

Tweet media two

1

1

10

0

20

47

@filar

Bobby Filar

2 years

Using GPT-3 to craft phishing emails to test against the @sublime_sec NLU engine is way more fun than I expected to have on a Monday afternoon.

Tweet media one

Tweet media two

2

7

43

@filar

Bobby Filar

6 years

Important ML+Infosec research from @MSFTResearch . "Neural Classification of Malicious Scripts: A study with JavaScript and VBScript" Highlights difficulties of building a proper dataset and challenges working w/ malicious scripts.

1

27

45

@filar

Bobby Filar

4 years

Finally published the research @threatpunter and I did on "ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships" for @virusbtn 2019.

Tweet card media

ProblemChild: Discovering Anomalous Patterns based on Parent-Child...

It is becoming more common that adversary attacks consist of more than a standalone executable or script. Often, evidence of an attack includes conspicuous process heritage that may be ignored by...

0

15

44

@filar

Bobby Filar

6 years

"Using Recurrent Neural Networks for Decompilation" Uses machine translation methods to decompile binaries. Really cool to see Deep Learning NLP techniques applied to the security space.

0

17

43

@filar

Bobby Filar

5 years

Re-reading @willcfleshman 's post on winning the Malware Evasion Comp. Excellent breakdown of potential blindspots in deep learning (MalConv) and tree-based (Ember) classifiers. Also good background on the malware features used in these models.

Tweet card media

Evading Machine Learning Malware Classifiers

for fun and profit!

towardsdatascience.com

0

20

43

@filar

Bobby Filar

4 years

I’m super excited that ML-backed Malware Prevention is being released under the free tier. Congrats to @mrphilroth and the rest of the Data Science team on getting this feature developed and released!

@elastic

Elastic

4 years

Elastic 7.9 is now available! Elastic Agent (beta) and one-click data ingestion simplify data onboarding and ingest management in the #ElasticStack . Plus, we’re launching malware prevention and Workplace Search features under the free distribution tier →

7

85

130

1

3

42

@filar

Bobby Filar

5 years

Looks like my @CamlisOrg talk was just posted. "ProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships" s/o to @threatpunter and @drhyrum for their contributions!

Tweet card media

ProblemChild: Discovering Anomalous Patterns based on Parent-Child...

CAMLIS 2019, Bobby FilarProblemChild: Discovering Anomalous Patterns based on Parent-Child Process Relationships (abstract: https://www.camlis.org/2019/talks...

www.youtube.com

0

11

41

@filar

Bobby Filar

4 years

"From 0 to 60 with Elastic Security" by @wesleyraptor is an excellent end-to-end tutorial on how to create an Adversary Simulation Environment, collect data, and explore the results w/in the Elastic ecosystem.

Tweet card media

From 0 to 60 with Elastic Security

This is a follow-up from my presentation on reinventing enterprise defense at ElasticON Security on August 19th, 2020. All too often when…

1

12

40

@filar

Bobby Filar

6 years

Posting slides from my @BsidesDC talk "Bringing Red vs. Blue to Machine Learning" High-level overview of adversarial ML nomenclature/techniques, plus "practical" application via scenario-based RvBs

Tweet card media

Bringing Red vs. Blue to Machine Learning

Bringing Red vs. Blue to Machine Learning - Download as a PDF or view online for free

www.slideshare.net

1

29

40

@filar

Bobby Filar

2 months

I cannot believe it's already been two years since I joined @sublime_sec . Super interesting work with a great group of people has made the time fly by. I cannot wait to see what comes next!

3

1

41

@filar

Bobby Filar

6 years

Kitsune: An Ensemble of Autoencoders for Online Network Intrusion Detection. Unsupervised approach to identifying network intrusions. Great section on adversarial attacks & countermeasures. Paper: Code:

Tweet card media

GitHub - ymirsky/KitNET-py: KitNET is a lightweight online anomaly detection algorithm, which uses...

KitNET is a lightweight online anomaly detection algorithm, which uses an ensemble of autoencoders. - ymirsky/KitNET-py

0

19

40

@filar

Bobby Filar

6 years

My talk proposal “Bringing Red vs. Blue to Machine Learning” was accepted!!!

@BsidesDC

BSidesDC

6 years

Speaker notifications are going out! If you submitted keep an eye on your inbox!

2

7

21

4

5

40

@filar

Bobby Filar

7 years

Awesome Machine Learning for Cyber Security by @jivoi Great resource for datasets, papers and talks

0

17

40

@filar

Bobby Filar

6 years

Adversarial Malware Binaries: Evading Deep Learning for Malware Detection in Executables by @biggiobattista et al. Targets the MalConv DL malware model. This group has been doing adversarial research for a while and their papers are fantastic!

2

22

40

@filar

Bobby Filar

6 years

Read about @EndgameInc taking over Vegas for BSides, BlackHat, DEFCON. Researchers include: @limbagoa @magerbomb @malwareunicorn @rseymour @drhyrum @dez_ @gabriellandau @comathematician @laborious_dtg @_LucienBrule ... and me

0

10

39

@filar

Bobby Filar

4 years

I'm worried that WFH is rubbing off on my 4y.o... She just came into my office, brow furrowed, saying "the server must be down or something" while holding an iPad w/ a crashed kid's app.

4

3

39

@filar

Bobby Filar

5 years

Pumped to have my talk "TreeHuggr: Discovering where tree-based classifiers are vulnerable to adversarial attack" accepted @USENIXSecurity ScAINet19

3

4

37

@filar

Bobby Filar

6 years

"Quantifying the Robustness of ML & Current Anti-Virus" by @willcfleshman & @EdwardRaffML introduces adversarial testing methodology focused on binary manipulations. Also excellent list of ML/infosec papers in the References section.

3

21

36

@filar

Bobby Filar

5 years

"Why We Release Our Research" @drhyrum , @comathematician and myself layout the importance of releasing ML research to the academic and infosec communities.

2

10

37

@filar

Bobby Filar

2 years

If you're going to @defcon , check out @aivillage_dc . They have a fantastic set of talks lined up: - @harini on modeling User Behavior - @NMspinach on hacking RL systems - Salma Taoufiq and Ben Gelman ( @SophosAI ) - Alert Prioritization - @drhyrum on this year's ML Evasion Comp!

1

8

35

@filar

Bobby Filar

3 years

If you are interested in how the @elastic Security Data Science team implemented a stack-based model for detecting anomalous parent-child processes, read our post on ProblemChild. Code and feature transforms made available too!

Tweet card media

ProblemChild: Detecting living-off-the-land attacks using the Elastic Stack

In this blog post, we train a classification model to identify malicious Windows process events and used anomaly detection to further uncover rare events. We are also releasing our models and...

0

12

37

@filar

Bobby Filar

4 years

My 4y.o. daughter is really getting into chess and lately she’s become obsessed with endgame puzzles. She likes writing down the notation to practice her letters/numbers.

Tweet media one

4

0

36

@filar

Bobby Filar

4 years

Excited to present "Getting Passive Aggressive About False Positives" @USENIXSecurity SCAINet in August w/ @EdwardRaffML . We will demonstrate how human-in-the-loop feedback via PA algorithms can enable global malware models to gain local knowledge to reduce FPs.

1

9

34

@filar

Bobby Filar

2 years

Fridays on our team are now "Research Fridays" to allow folks to nerd out on an applied SecML/MLOps problem. I spent the day implementing the transformer in URLTran: Improving Phishing URL Detection w/ @PyTorch & @huggingface Paper, code, and data tips:

Tweet card media

GitHub - bfilar/URLTran: PyTorch/HuggingFace Implementation of URLTran: Improving Phishing URL...

PyTorch/HuggingFace Implementation of URLTran: Improving Phishing URL Detection Using Transformers - bfilar/URLTran

1

6

33

@filar

Bobby Filar

6 years

"Neural Machine Translation Inspired Binary Code Similarity Comparison beyond Function Pairs" Really neat use of NLP techniques applied to the security domain. Paper: Model/Embeddings:

Tweet card media

Neural Machine Translation Inspired Binary Code Similarity...

Binary code analysis allows analyzing binary code without having access to the corresponding source code. A binary, after disassembly, is expressed in an assembly language. This inspires us to...

2

13

34

@filar

Bobby Filar

2 years

Acquiring a dataset for Macro-based malware classification is tough! However, yesterday I stumbled across this paper/dataset containing featurized and raw macro data. It is an excellent place to start experimenting. Dataset: Paper:

1

6

33

@filar

Bobby Filar

1 year

Just gave a shout out to my 7 year old during my BSidesLV talk. I told we her it was going to be streamed and she naturally assumed I’m a YouTube star.

2

0

34

@filar

Bobby Filar

6 years

End-to-End Active Learning for Computer Security Experts. Useful looking interface for labeling data and training/analyzing models. Github: Paper:

Tweet card media

GitHub - ANSSI-FR/SecuML: Machine Learning for Computer Security

Machine Learning for Computer Security. Contribute to ANSSI-FR/SecuML development by creating an account on GitHub.

0

15

33

@filar

Bobby Filar

7 years

Pumped to see @EndgameInc listed in the AI 100 by @CBinsights

Tweet media one

1

13

30

@filar

Bobby Filar

4 years

I the ported code from the @EndgameInc paper "Predicting Domain Generation Algorithms using LSTMs" over to py3 and Tensorflow 2. Updates to DGA datasets and interpretability methods coming soon.

Tweet card media

GitHub - bfilar/dga_predict: Pytorch Implementation of "Predicting Domain Generation Algorithms...

Pytorch Implementation of "Predicting Domain Generation Algorithms using LSTMs" - bfilar/dga_predict

1

13

29

@filar

Bobby Filar

6 years

Had a blast presenting my talk “Bringing Red vs. Blue to ML” today @BsidesDC Thanks for all who stuck around until the end and asked such great questions!

2

4

29

@filar

Bobby Filar

5 years

Really excited to be a part of the new Security Data Science Team @elastic !

@elastic

Elastic

5 years

We’ve officially joined forces with @EndgameInc . Hear from CEO Shay Banon ( @kimchy ) and Endgame CEO Nate Fick ( @ncfick ) live on Oct. 15 at 8:30 a.m. EDT to learn more about what we have in store →

Tweet media one

0

61

91

1

3

31

@filar

Bobby Filar

1 year

Excited that my @BSidesLV talk has been accepted! I will be introducing BabbelPhish, our upcoming open source framework for text-to-code generation. I'll also show how @sublime_sec uses LLMs to make it easier for detection engineers to grasp our DSL.

2

6

31

@filar

Bobby Filar

5 years

. @andyplayse4 presenting on making Meterpreter an Adversarial Example. Using some research from @EndgameInc on Reinforcement Learning for Malware Evasion.

0

15

31

@filar

Bobby Filar

5 years

Tons of good info in "Spotting Lateral Movement" by @ForensicITGuy presented at @BSidesAugusta

Tweet card media

Spotting Lateral Movement - BSides Augusta 2019

Lateral movement is an integral part of adversary movement into and around networks. This functionality is now built into relatively inexpensive and wid…

speakerdeck.com

0

8

30

@filar

Bobby Filar

6 years

Detecting Malicious PowerShell Commands using Deep Neural Networks. Another interesting application of DL/NLP techniques being used to solve infosec problems.

Tweet card media

Detecting Malicious PowerShell Commands using Deep Neural Networks

Microsoft's PowerShell is a command-line shell and scripting language that is installed by default on Windows machines. While PowerShell can be configured by administrators for restricting access...

0

13

31

@filar

Bobby Filar

2 years

A new Python-based parser for preprocessing and feature engineering on Portable Executable (PE) files. This is a great way to start ML research on windows binaries. - metadata - ngrams - entropy - generate grayscale image representations.

2

10

30

@filar

Bobby Filar

8 years

My @PyDataDC talk is up on building chatbots in Python. Awkward dad jokes all over the place...

Tweet card media

Bobby Filar | Bot or Not? The Illusion of Intelligence

PyData DC 2016Chatbots have become wildly popular interfaces for online services we use everyday. While these bots are not going to pass the Turing Test, the...

www.youtube.com

1

11

29

@filar

Bobby Filar

8 years

If you thought the Iliad was too short and love Reverse Engineering check out @MalwareMechanic 's post on @EndgameInc

2

18

27

@filar

Bobby Filar

2 years

Reinforcement learning is easily my favorite research to dig into, and a user has compiled a list of RL in Security Papers/Github codebases to catch up on the latest developments!

Tweet card media

GitHub - Limmen/awesome-rl-for-cybersecurity: A curated list of resources dedicated to reinforcem...

A curated list of resources dedicated to reinforcement learning applied to cyber security. - GitHub - Limmen/awesome-rl-for-cybersecurity: A curated list of resources dedicated to reinforcement le...

4

10

29

@filar

Bobby Filar

4 years

WFH @zoom_us meetings in DC...

Tweet media one

1

0

29

@filar

Bobby Filar

6 years

Happy Father’s Day everyone! Here is my daughter getting into a dance off with a windsock.

0

1

29

@filar

Bobby Filar

1 year

We took our 7 year old to San Diego for her spring break. After the zoo, we went to a brewery where we saw her go up to the bartender to order a Sprite and pretzels and say “put it on my parents tab. It’s under filar”.

2

0

29

@filar

Bobby Filar

7 years

New headshot courtesy of @OReillySecurity was interrupted by a clever girl

Tweet media one

1

3

29

@filar

Bobby Filar

6 years

A few awesome things my fellow @EndgameInc -ers did recently @malwareunicorn @_devonkerr_ and intern (on his 1st day) deep dive into Olympic Destroyer malware … Then @rseymour put a natural language interface on top of @radareorg

Tweet card media

radare2 In Conversation - Richard Seymour

The command line hexadecimal editor, disassembler and debugger radare2 can be an invaluable reverse engineering tool. Even users of IDA Pro can find use in r...

www.youtube.com

0

6

28

@filar

Bobby Filar

6 years

"Detecting Homoglyph Attacks with a Siamese Neural Network" Presented @IEEESSP workshop by @EndgameInc researchers @drhyrum @jack8daniels2 and Daniel Grant. Targets name spoofing commonly used to obfuscate file and domain names in malware/C2 comms.

Tweet card media

Detecting Homoglyph Attacks with a Siamese Neural Network

A homoglyph (name spoofing) attack is a common technique used by adversaries to obfuscate file and domain names. This technique creates process or domain names that are visually similar to...

0

10

27

@filar

Bobby Filar

6 years

Highlights from @drhyrum & @phtully #RSAC18 talk on "Navigating the Data Labeling Bottleneck as Security Embraces Artificial Intelligence"

Tweet media one

Tweet media two

Tweet media three

Tweet media four

1

17

24

@filar

Bobby Filar

5 years

Deceiving Portable Executable Malware Classifiers into Targeted Misclassification with Practical Adversarial Samples. Comprehensive lit review and interesting approach from the authors.

0

4

26

@filar

Bobby Filar

3 months

If you are at RSA next week, swing by the @sublime_sec booth, so we can talk about: - Email security - Machine learning - The Minnesota Timberwolves

@sublime_sec

Sublime Security

3 months

If you're attending RSA next week: @filar will give a talk at our booth on Tues & Wed at 10:45am. Learn how explainable, transparent machine learning provides much-needed confidence and context in your triage workflow.

Tweet media one

0

2

7

2

4

27

@filar

Bobby Filar

6 months

New mantra just dropped…

Tweet media one

4

2

26

@filar

Bobby Filar

4 years

Thinking about starting a food truck in DC for election season called "The Deep Steak" Let me know if you'd like to invest.

5

4

25

@filar

Bobby Filar

6 years

Packed house @aivillage_dc for @magerbomb talk on using Sentiment Analysis to identify notes dropped by ransomware.

Tweet media one

0

7

26

@filar

Bobby Filar

5 years

Excited to present TreeHuggr: Discovering Where GBDTs are Vulnerable to Adversarial Attack at @USENIXSecurity ScAINet Workshop this morning!

0

3

25

@filar

Bobby Filar

6 years

Congrats to the @EndgameInc researchers for getting their paper "Detecting Homoglyph Attacks with a Siamese Neural Network" accepted in to the @IEEESSP Deep Learning & Security Workshop! Looks like a great list of talks!

Tweet media one

1

6

26

@filar

Bobby Filar

6 years

"TreeHuggr: Discovering where tree-based classifiers are vulnerable to adversarial attack" was accepted to @CamlisOrg !!!

1

7

26

@filar

Bobby Filar

5 years

"Feature Selection for Malware Detection Based on Reinforcement Learning" An agent is trained through Q-learning to maximize expected accuracy. Action space covers PE header, section and import table.

Tweet media one

1

9

24

@filar

Bobby Filar

6 years

Anyone working on Insider Threat detection? @SEInews has a pretty neat dataset that provides both background and malicious actor synthetic data. Data: Paper:

Tweet card media

Insider Threat Test Dataset

The Insider Threat Test Dataset is a collection of synthetic insider threat test datasets that provide both background and malicious actor synthetic data.

insights.sei.cmu.edu

1

6

25

@filar

Bobby Filar

6 years

Part 2 of the "Detecting Phishing With Computer Vision" series by @EndgameInc researchers @laborious_dtg and Bill Finlayson. Provides a great overview of CV techniques and how they applied the YOLO object detection framework. Lots of code samples too!

0

15

24

@filar

Bobby Filar

6 years

How AI can help in infosec (if it can fight through the marketing hype) by @lilyhnewman @mrphilroth offers his opinion and shares some valuable insights he gained while creating @EndgameInc malware classifier and the Ember dataset.

Tweet card media

AI Can Help Cybersecurity—If It Can Fight Through the Hype

There are a ton of claims around AI and cybersecurity that don't quite add up. Here's what's really going on.

0

9

25

@filar

Bobby Filar

3 years

If you are interested in detecting Living off the Land attacks using the @elastic Stack ML feature check out our webinar "ProblemChild in the Stack" next week!

Tweet card media

ProblemChild in the Stack

In-person Event - Learn how to apply machine learning to security data in the Elastic Stack with ProblemChild, a framework which flags rare malicious processes to help security/malware analysts...

community.elastic.co

0

12

23

@filar

Bobby Filar

6 years

"MEADE: Towards a Malicious Email Attachment Detection Engine" by @rharang & @joshua_saxe Super interesting research highlighting features to leverage, classifier comparison, and future research considerations.

0

7

24

@filar

Bobby Filar

6 years

"Anomaly Detection in Cyber Network Data Using a Cyber Language Approach" by @keeghin and team. Creates a language to build a probabilistic tree structure to identify interesting network events.

Tweet card media

Anomaly Detection in Cyber Network Data Using a Cyber Language Approach

As the amount of cyber data continues to grow, cyber network defenders are faced with increasing amounts of data they must analyze to ensure the security of their networks. In addition, new types...

1

15

24

@filar

Bobby Filar

4 years

Explaining to my 3y.o. a proposal I just saw that would give her $1K. Me: "What would you do with $1000?" C: "A $1000 cash money?" Me: "Yep." C: "I would probably put that into my ice cream shop" Reinvesting in her small business...

2

2

23

@filar

Bobby Filar

5 years

Are you interested in machine learning & security? My team at @elastic is hiring a Security Data Scientist. Come work on malware classification, detecting anomalous events, and more!

0

12

24

@filar

Bobby Filar

4 years

Elastic Security Data Science is looking for a Security Researcher to help grow our malware prevention capabilities. If you have experience in malware analysis or RE w/ a passion for ML we want to hear from you! DM if you have any questions.

1

20

24

@filar

Bobby Filar

2 years

We added a new member to the family! Meet Frankie

Tweet media one

1

0

23

@filar

Bobby Filar

1 year

One year in @sublime_sec 🫡 @jkamdjou @ianthiel

Tweet media one

1

1

24

@filar

Bobby Filar

4 years

I’m super excited to have @gradientjanitor onboard the Security Data Science team @elastic starting today! Interested to see what he and @mrphilroth cook up for Malware Classification.

1

0

23

@filar

Bobby Filar

6 years

If you needed another reason to attend @aivillage_dc this weekend @Andrew___Morris is providing 60 days of @GreyNoiseIO API access for those who stop by. Check out his talk this Friday @ 1:20pm

0

10

23

@filar

Bobby Filar

6 years

Best papers I read this week: "Statistical Estimation of Malware Detection Metrics in the Absence of Ground Truth" "Two Can Play That Game: An Adversarial Evaluation of a Cyber-alert Inspection System"

Tweet card media

Statistical Estimation of Malware Detection Metrics in the Absence...

The accurate measurement of security metrics is a critical research problem because an improper or inaccurate measurement process can ruin the usefulness of the metrics, no matter how well they...

0

9

23

@filar

Bobby Filar

3 years

Spent some time this weekend building a simple (crappy) annotation platform for a NER model I'm building. The idea is to extract entities from poorly written vulnerability reports to grab software name/version info.

Tweet media one

Tweet media two

Tweet media three

3

0

23