3 ms·

I read the whitepaper that was linked in the github but I'm still not totally sure what makes a network device "interesting". I'm still sort of curious, but I

• _soruso 7y ago
  First, it starts with the hypothesis that you don't know exactly what you are looking for in advance, so an "interesting" asset would pop out as an unusual combination of these grep lookups (ssh, http, mysql, ftp, rdp, smb, etc...) or other features (hostnames, os type). It means you would have to look for all possible combinations of these oneliners? Second, on an enterprise network, you could easily have 5k or 50k devices to grep, which would make it unfeasible to combine simple greps. The reason we use machine learning is because it is targetted for large amount of data, i.e. enterprise networks.
• deleted 7y ago
  [deleted]