4 ms·
Is there any evidence that this works in the sense of foiling sophisticated attacks?
by mafribe 10y ago
Is there any evidence that this works in the sense of foiling sophisticated attacks?
- pilooch 10y agoAFAIK not really. Detecting C&C is not that easy in unsupervised settings. The MIT paper (link in the TC article) makes claims, but this is mostly PR. There are some reports from Google as well that you may find around, and at least at the time (few years back) they make the same observation we do with my coworkers: the rate of false positive remains high, and thus it is the job of trained security operators to spot the sophisticated attacks. Empowering the operators with more data mining tools is a good step not yet fulfilled I believe.
- hannob 10y agoIf you ask "Is there any evidence for ..." for so-called IT security products then the answer is practically always "No".