Home-grown machine learning implementation for a SIRT: A use case — detecting domain-generating algorithms

Abstract

There is a flurry of discussion, press and vendors explaining how helpful data science techniques can assist in cyber security defence; however, there is little information available about how to effectively leverage and implement data science techniques within a company’s cyber security defence team. The goal of this paper is to empower security incident response teams (SIRTs) to seamlessly build, deploy and operate ML solutions at scale. Our proposed solution is designed to cover the end-to-end ML workflows. Take-aways include managing and deploying a prediction pipeline, training data, prediction model evaluations and continuously monitoring these deployments to assist in SIRTs’ ability to defend and thwart cyber security attacks. An additional use case of implementing a machine learning (ML) application to predict domain-generating algorithms with the integrated data science pipeline and platform is also discussed and used as a reference.