BEGIN:VCALENDAR
VERSION:2.0
PRODID:-//pretalx//pretalx.com//bsideslv24//speaker//CJK9WL
BEGIN:VTIMEZONE
TZID:PST
BEGIN:STANDARD
DTSTART:20001029T030000
RRULE:FREQ=YEARLY;BYDAY=-1SU;BYMONTH=10;UNTIL=20061029T100000Z
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:STANDARD
DTSTART:20071104T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=11
TZNAME:PST
TZOFFSETFROM:-0700
TZOFFSETTO:-0800
END:STANDARD
BEGIN:DAYLIGHT
DTSTART:20000402T030000
RRULE:FREQ=YEARLY;BYDAY=1SU;BYMONTH=4;UNTIL=20060402T110000Z
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
BEGIN:DAYLIGHT
DTSTART:20070311T030000
RRULE:FREQ=YEARLY;BYDAY=2SU;BYMONTH=3
TZNAME:PDT
TZOFFSETFROM:-0800
TZOFFSETTO:-0700
END:DAYLIGHT
END:VTIMEZONE
BEGIN:VEVENT
UID:pretalx-bsideslv24-CPCZUG@pretalx.com
DTSTART;TZID=PST:20240807T170000
DTEND;TZID=PST:20240807T174500
DESCRIPTION:Detecting multi-stage cyber attacks is challenging as incidents
  are often disjointed and hidden among noise. Current correlation rules ha
 ve limited effectiveness due to inconsistent alert tagging and lack of com
 plexity to model full attack flows.\nThis talk explores using open-source 
 AI models to connect disparate security events into cohesive MITRE ATT&CK 
 campaigns. We leverage large language models to classify alerts with relev
 ant ATT&CK techniques\, and graph models to cluster related events\, estab
 lishing incident context. A tailored model then cross-correlates and chain
 s these clusters\, probabilistically revealing full ATT&CK flows.\nExperim
 ents across public and private datasets showcase the approach's ability to
  accurately correlate slow\, stealthy attack chains that evade traditional
  detection. Key findings\, use cases\, and limitations are presented.\nNov
 el aspects include using subject matter expert language models for alert e
 nrichment\, transforming enriched data into temporal knowledge graphs\, an
 d applying hierarchical clustering and Markov models to probabilistically 
 chain incidents into campaigns.\nThis lays groundwork for a new era of ope
 n\, cutting-edge security analytics to thwart cyber threats by prioritizin
 g targeted campaigns over individual incidents. Perspectives are shifted f
 rom narrow correlation rules to capturing diverse attack flows hiding in t
 he noise.
DTSTAMP:20260715T105825Z
LOCATION:Siena
SUMMARY:ZERO-RULES Alert Contextualizer & Correlator - Ezz Tahoun
URL:https://pretalx.com/bsideslv24/talk/CPCZUG/
END:VEVENT
END:VCALENDAR