2 ms·
I'm glad to see innovation in this area. I have a few questions. Can you tell me where (or even how) you acquired the data to train your machine learning syste
by dsacco 10y ago
I'm glad to see innovation in this area. I have a few questions.
Can you tell me where (or even how) you acquired the data to train your machine learning system?
If you could go into some detail about the specific techniques you've used that would also be great to know.
Finally, what does your service do that is not provided by something like SiftScience? I imagine there is overlap here - is it that you primarily focus on web application security instead of fraud signaling?
- jasontan 10y agoCEO and cofounder of Sift Science here. I think we are complementary, actually. Wallarm focuses on security vulnerabilities (like a more automated HackerOne), and we focus more on "application abuse" (user-level fraud). Great job, Wallarm!
- dsacco 10y agoThat's what I figured, I was just hoping to get a bit more nuance on the security vulnerabilities. I actually thought Hackerone or Bugcrowd would be first to market with a product like this.
- hkr_mag 10y agoHackerone and Bugcrowd do a great job. And we recommmend to run bug-bounty programs all the time. But companies which run fast and deploy code everyday with CI/CD (or several times a day) it's almost impossible not to introduce new vulnerabilities. This is where solutions for continuous security are incredibly helpful.
- hkr_mag 10y agoThanks Jason! Will be at DEFCON this year? It'll be great to meet there.
- deleted 10y ago[deleted]
- hkr_mag 10y agoThanks for feedback! 1. Customers analyze traffic with locally installed NGINX-based instances (there is not DNS take-over). They send applications/traffic statistics to Wallarm Cloud so we can run machine-learning stuff. We had a lot of work done for initial training of the system using our own experience in web app security (more than 250+ pentests for top-tier companies + a lot of researches done by our team like SSRF bible). We also use different honeypots and now statistics of customers with a high volume traffic. 2. There are some details about ML technique covered by Ivan for another comment 3. We have different tasks with SiftScience. SiftScience provides a fraud-detection. Wallarm protects web apps and APIs against data breaches. But these tasks are related for some of our customers.
- dsacco 10y agoThanks for the answers. I have clarifying questions: How much of your machine learning is used for understanding the application (as Ivan said elsewhere, clustering login functionality together), and how much is actually used for fingerprinting vulnerability identification attempts on the part of user input? To place this in a broader context, you do not need machine learning for identifying many cases of malicious user input, you can rely on simple heuristics. There is likely no reason for a user to submit `<script>alert(1);</script`, which is an obvious test for XSS low hanging fruit. Any good WAF will do this. Given that, does Wallarm use mostly heuristics for identifying malicious user input, or does it also combine machine learning into this process at all to find non-obvious input patterns that could be indicative of penetration testing attempts?
- wlrm 10y agoOur attack type recognition based on machine learning which can at first produce lexems and, secondly. syntax constructions (patterns) by existing attacks. For example, in the case of memcached injections (more details: https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-The-New-Page-Of-Injections-Book-Memcached-Injections-WP.pdf https://www.blackhat.com/docs/us-14/materials/us-14-Novikov-...) we can train system to detect these attacks without regexps or new heuristic rules.