Cymon.io Open Threat Intelligence 29 October 2015 Copyright 2015 esentire, Inc. 1
#> whoami» Roy Firestein» Senior Consultant» Doing Research & Development» Other work include:» docping.me» threatlab.io 29 October 2015 Copyright 2015 esentire, Inc. 2
Agenda» About Cymon» Use Cases» Existing Tools» Machine Learning in Cymon» Architecture and Design 29 October 2015 Copyright 2015 esentire, Inc. 3
ABOUT CYMON
Why Cymon? 253.99.17.148 Malicious? History Network 29 October 2015 Copyright 2015 esentire, Inc. 5
29 October 2015 Copyright 2015 esentire, Inc. 7
About» Largest tracker of security reports» Malware» Phishing» Botnets» Others.. 29 October 2015 Copyright 2015 esentire, Inc. 8
About» 20,000+ unique IPs saved daily 29 October 2015 Copyright 2015 esentire, Inc. 9
About» Almost 200 sources ingested daily» VirusTotal» Phishtank» Blacklists» Antivirus vendors 29 October 2015 Copyright 2015 esentire, Inc. 10
Quick Stats 4.6+ Million 26.2+ Million IP Addresses Security Events 29 October 2015 Copyright 2015 esentire, Inc. 11
Events Acquisition Chart 29 October 2015 Copyright 2015 esentire, Inc. 12
IPs with most sources 29 October 2015 Copyright 2015 esentire, Inc. 13
Web Interface» Free access» Search database for» IPs» Domains» URLs» Hashes 29 October 2015 Copyright 2015 esentire, Inc. 14
Web Interface - Events Timeline 29 October 2015 Copyright 2015 esentire, Inc. 15
IP Reputation Examples» https://cymon.io/112.78.7.162» https://cymon.io/198.50.209.4» https://cymon.io/84.241.182.218 29 October 2015 Copyright 2015 esentire, Inc. 16
Globe Visualization http://cymon.io/globe 29 October 2015 Copyright 2015 esentire, Inc. 17
Map Visualization http://cymon.io/map 29 October 2015 Copyright 2015 esentire, Inc. 18
API Interface» We currently offer free API access for testing» Contact me for details http://docs.cymon.io 29 October 2015 Copyright 2015 esentire, Inc. 19
Twitter Robot» @cymonbot» Replies to tweets containing IP addresses» Natural language responses 29 October 2015 Copyright 2015 esentire, Inc. 20
USE CASES
Firewall RBL» Dynamic block list 29 October 2015 Copyright 2015 esentire, Inc. 22
DGA Analysis» Detect malware domains http://cymon.io/dga 29 October 2015 Copyright 2015 esentire, Inc. 23
Apache Log Analysis https://gist.github.com/0xf1/d27138f40d2254f8de20 29 October 2015 Copyright 2015 esentire, Inc. 24
CYBER MONITORING
Cyber Monitoring» Brands, domains, emails» Supported sources:» Pastebin sites» Bit Torrent sites» Twitter 29 October 2015 Copyright 2015 esentire, Inc. 26
ElasticSearch Data 29 October 2015 Copyright 2015 esentire, Inc. 27
Cyber Monitoring» DNS Monitoring» Alerting when records change» Passive IP Monitoring» Passive Domain Monitoring 29 October 2015 Copyright 2015 esentire, Inc. 28
Event Example: Pastebin 29 October 2015 Copyright 2015 esentire, Inc. 29
Passive Pentesting 29 October 2015 Copyright 2015 esentire, Inc. 30
Dashboard 29 October 2015 Copyright 2015 esentire, Inc. 31
Cymon Alternatives OTHER TOOLS
Soltra Edge 29 October 2015 Copyright 2015 esentire, Inc. 33
Threat Connect 29 October 2015 Copyright 2015 esentire, Inc. 34
Threat Stack 29 October 2015 Copyright 2015 esentire, Inc. 35
MozDef» Helps automate the security incident handling process» https://github.com/jeffbryner/mozdef 29 October 2015 Copyright 2015 esentire, Inc. 36
MozDef += Cymon 29 October 2015 Copyright 2015 esentire, Inc. 37
MACHINE LEARNING 29 October 2015 Copyright 2015 esentire, Inc. 38
Machine Learning Features Prediction Input Output 29 October 2015 Copyright 2015 esentire, Inc. 39
Machine Learning 101» Need lots of data» Two learning methods» Supervised» Unsupervised» The computer will figure it out 29 October 2015 Copyright 2015 esentire, Inc. 40
Starting point myskmlsnvkrgr.cc Starting point yourcloud.com myskmlsnvkrgr Remove TLD yourcloud Extract Features (data points) 29 October 2015 Copyright 2015 esentire, Inc. 41
What data point can we extract?» Length» Entropy» Words» Mean word length» Median word length» Gebberish probability» Domain name 29 October 2015 Copyright 2015 esentire, Inc. 42
Building Training Dataset Good Bad Alexa Top 1M NetCraft DGA Trackers esentire Feed Feature Extraction 29 October 2015 Copyright 2015 esentire, Inc. 43
Building Training Dataset Extracted Features Final Dataset Randomize 29 October 2015 Copyright 2015 esentire, Inc. 44
TECHNOLOGY AND ARCHITECTURE
Technology Stack» Amazon AWS» Django (Python)» Node.js» Docker» ElasticSearch 29 October 2015 Copyright 2015 esentire, Inc. 46
Architecture Benefits» Scale up quickly» Can handle millions of API requests» Highly Available» Clone environment for testing in one click» Automatic database backups and recovery» Extremely detailed infrastructure logs and alerts» Cost savings compared to traditional deployments 29 October 2015 Copyright 2015 esentire, Inc. 47
Architecture Components 1. Data tier 2. Workers tier 3. Web application tier 29 October 2015 Copyright 2015 esentire, Inc. 48
Worker Diagram 29 October 2015 Copyright 2015 esentire, Inc. 49
COMING SOON
Google Chrome Plugin github.com/esentire/cymon-interceptor 29 October 2015 Copyright 2015 esentire, Inc. 51
Integration with Threat Lab www.threatlab.io 29 October 2015 Copyright 2015 esentire, Inc. 52
Created by you» Firefox plugin» Library for Ruby / Node / C#...» Firewall plugin» Proxy plugin» IDS plugin» Maltego Transforms 29 October 2015 Copyright 2015 esentire, Inc. 53
Thank You! github.com/esentire +1 866 579 2200 roy.firestein@esentire.com www.esentire.com @royfire 29 October 2015 Copyright 2015 esentire, Inc. 54