Download presentation
Presentation is loading. Please wait.
1
Our Solutions Focus: Threat Detection and Investigation
Start
2
Progression of LigaData
2016 2015 Threat Detection and Investigation Solutions Integration and development of full suite of solution components 2014 Crystalized Architecture & Tech Stack Extended Lambda Architecture Launched Kamanja Engagements Fraud Compliance Risk Surveillance Cyber Security
3
Threat Detection and Investigation Process
There’s a pattern here… Detect Investigate Ingest Applies to: Unauthorized Trades Credit Card Fraud Financial Crime Insider Threats Cyber Threats … Learn
4
Use Case: Unauthorized Trades
Interactive Analysis Risk Reporting Exploratory Dashboards Real-Time Threat Monitoring Behaviour Pattern Risk Scoring Abnormal Trade Behaviours Detect Investigate Ingest Structured and Unstructured Sources Trade Data Control Data P&L Counterparty Data E-communications HR data Learn Developing Algorithms Risk Models Unsupervised outlier detection
5
Use Case: Credit Card Fraud
Interactive Analysis Incident, customer, merchant, and geo-based drill-through and investigation Real-Time Transaction Authorization & Monitoring Model-based transaction scoring Rules-based authorization Detailed decision data for auditing Detect Investigate Ingest Streaming and Batch Sources Transactional Data FICO scores Web activity App activity IVR Learn Developing Algorithms Scoring Models Profiling Models
6
Use Case: Financial Crime
Interactive Analysis Link analysis on customers, payments, and transactions Social media and geo analytics Real-Time Threat Monitoring Payments screen Customer screen Transaction monitoring Watchlist filter Risk assessment Detect Investigate Ingest First- and Third- Party Sources Payments, transactions, customer information, reference data Court orders, fraud data, social media Learn Developing Algorithms Machine learning Logistic regression Dimension redux Alert prioritization
7
Use Case: Insider Threats
Interactive Analysis Risk Reporting Compliance dashboard Admin & Threshold management screens Real-Time Threat Monitoring Unusual access behavior Pattern recognition Terminated user login threat Detect Investigate Ingest Machine and Master Data Sources Application logs HR data Reference metadata Learn Developing Algorithms User and segment pattern models ”Joiner” and “Leaver” models Outlier detection models
8
Use Case: Cyber Threats
Interactive Analysis Deep incident drill-through Time series and correlation analysis Graph and geo analysis Real-Time Threat Monitoring Matching related incidents Transforming and scoring incidents Pattern analysis Detect Investigate Ingest Streaming/Batch Structured/Unstructured First-/Third-Party Machine/Master Sources Web and server logs eCommunications FS-ISAC, malware signatures HR Data Learn Developing Algorithms Supervised learning for higher SNR Unsupervised learning for outlier detection Let’s dig in…
9
The Cyber Security Landscape
90MM 70% Cyber attacks go undetected The Wall Street Journal estimated the cost of cyber crime in the US was $100 Billion Lloyds estimated that cyber attacks cost businesses $400 Billion Juniper research predicts the rapid digitization of consumers will increase the cost of cyber attacks to $2.1 Trillion According to the Wall Street Journal, BofAML reported there were 90MM cyber attacks in 2015 of which 70% went undetected
10
Historic Approach to Cyber Security: Flu Shot Defense
Company Updates Security with New Protocols New Cyber Attack Developed Security Protocols Updated Patient Takes Vaccine New Flu Strain Attacks Patient New Flu Vaccine Developed A vaccine for last year’s viruses may not help this year
11
New Approach to Cyber Security: Gene Therapy Defense
Organization Adopts Advanced Detection and Investigation Capabilities Patient Undergoes Gene Therapy Organization Immediately Defends Against Attack Organization Attacked by New Cyber Threat Patient’s Immune System Fights Off Flu New Flu Strain Attacks Patient
12
Next Advance in Cyber Security: Collective Immune System
Watch this space…
13
What are “Advanced Detection and Investigation Capabilities”?
Immediate Detection Powerful Investigation tools Effective Interfaces to manually configure rules Machine-Learning to create and adapt algorithms Fast Productionization of new algorithms Scalability to complex models and “Three Vs” of data What other capabilities do you require?
14
The LigaData Solution The Pattern The Architecture
15
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
16
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
17
Continuous Decisioning
Immediate Detection Investigation Tools Effective Interfaces Machine-Learning Fast production Scalability Soonest possible detection of potential threats An efficient way to operationalize new detection algorithms (minimize time from data science to market) The ability to apply the most sophisticated algorithms to the most amount of streaming and historical data Ability to quickly and easily update detection algorithms with human-generated rules (coming soon)
18
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
19
Model Development Immediate Detection Investigation Tools Effective Interfaces Machine-Learning Fast production Scalability Support for all tools of choice of data scientists is a necessity
20
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
21
Graph Analysis Pros Limitations Very fast joins Link analysis
Immediate Detection Investigation Tools Effective Interfaces Machine-Learning Fast production Scalability Pros Very fast joins Link analysis Powerful Visualization Limitations Scale of data
22
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
23
Dashboarding and Search
Immediate Detection Investigation Tools Effective Interfaces Machine-Learning Fast production Scalability Pros Scale of data Very fast queries Useful visualization Limitations No joins
24
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
25
Reporting and Drill-Through
Immediate Detection Investigation Tools Effective Interfaces Machine-Learning Fast production Scalability Addresses use cases not well supported by graph DBs or indexed document (NoSQL) DBs. Key Point: duplication of data is required to meet the functional and non-functional requirements of different use cases. Hence, so is governance.
26
Solution Architecture for Detection & Investigation Implementing the Extended Lambda Architecture
INGESTION DETECTION FOUNDATION INVESTIGATION Data and Concept Models Case Management Continuous Decisioning Graph Analysis & Visualization Data Ingestion Data Lake Models Dashboarding & Drill-Through Model Development & Execution Search Data Store Access & Control User Interface Reporting & Drill-Through Monitoring Models
27
Key Takeaways Threat Detection and Investigation use cases are increasing in # and importance Addressed by a solution architecture featuring primarily open source technologies LigaData is building and integrating the components to deliver the complete stack
28
Thank you!
Similar presentations
