3 ms·

It seems like one way to mitigate security vulnerabilities is to write software that looks for statistical anomalies. Attempting 1 million passwords in 28 minut

It seems like one way to mitigate security vulnerabilities is to write software that looks for statistical anomalies. Attempting 1 million passwords in 28 minutes is such an obvious outlier that it's strange we have to guard against it explicitly. It would also catch cheats in video games, for example, since those are statistical outliers too. Is there a name for this kind of program?

eat_veggies 6y ago
Yep, it's called novelty and outlier detection. The sklearn page is pretty informative: https://scikit-learn.org/stable/modules/outlier_detection.html https://scikit-learn.org/stable/modules/outlier_detection.ht...
caiobegotti 6y ago
Even a really crude monitoring metric would trigger alerts after a bunch of recurring calls to an endpoint from a specific place. They simple don't care at all or are too dumb to come up with basic security checks.
- nitrogen 6y ago
  Until it's a default in frameworks like Spring Boot and in ELK stack logging systems, in most places it's not happening.
- wdb 6y ago
  Got any examples of such monitoring metric setup? Would love to get an idea what it's good to monitor :) I am thinking of using Grafana with Prometheus. Love to find a nice resource with good ideas of rules/monitoring to have
  - caiobegotti 6y ago
    That's exactly what I do (or would) use and it does plenty for many type of business and it scales up well. The metrics specifically depend on the rest of your stack though but these days any API gateway or ingress application or service mesh or proxy app can provide endpoints metrics for you nearly out-of-the-box.
boarnoah 6y ago
Valve has an interesting talk about this with respect to VAC [1]. Which like you suggest relies heavily on statistical evidence from multiple replays in order to detect cheats. In CSGO's case they test it against their existing system Overwatch which uses player moderators to detect cheats). With their other big title dota as far as I'm aware its fully automated. 1 - "GDC 2018: John McDonald (Valve) - Using Deep Learning to Combat Cheating in CSGO" - https://www.youtube.com/watch?v=ObhK8lUfIlc https://www.youtube.com/watch?v=ObhK8lUfIlc

eat_veggies 6y ago

Yep, it's called novelty and outlier detection. The sklearn page is pretty informative: https://scikit-learn.org/stable/modules/outlier_detection.html https://scikit-learn.org/stable/modules/outlier_detection.ht...

caiobegotti 6y ago

Even a really crude monitoring metric would trigger alerts after a bunch of recurring calls to an endpoint from a specific place. They simple don't care at all or are too dumb to come up with basic security checks.

nitrogen 6y ago
Until it's a default in frameworks like Spring Boot and in ELK stack logging systems, in most places it's not happening.
wdb 6y ago
Got any examples of such monitoring metric setup? Would love to get an idea what it's good to monitor :) I am thinking of using Grafana with Prometheus. Love to find a nice resource with good ideas of rules/monitoring to have
- caiobegotti 6y ago
  That's exactly what I do (or would) use and it does plenty for many type of business and it scales up well. The metrics specifically depend on the rest of your stack though but these days any API gateway or ingress application or service mesh or proxy app can provide endpoints metrics for you nearly out-of-the-box.

boarnoah 6y ago

Valve has an interesting talk about this with respect to VAC [1]. Which like you suggest relies heavily on statistical evidence from multiple replays in order to detect cheats. In CSGO's case they test it against their existing system Overwatch which uses player moderators to detect cheats). With their other big title dota as far as I'm aware its fully automated. 1 - "GDC 2018: John McDonald (Valve) - Using Deep Learning to Combat Cheating in CSGO" - https://www.youtube.com/watch?v=ObhK8lUfIlc https://www.youtube.com/watch?v=ObhK8lUfIlc