Hands-On Machine Learning for Cybersecurity

Modeling

This is a simple model that stocks in historical data features (the ones listed in the Data parsing section) that are associated with Windows logs. When a new feature parameter comes in, we see whether this is a new one by comparing to the historical data. Historical data could include AD logs with res to the features from over a year ago. The AD event that we will use for this purpose is 4672.

For the purposes of a use case, we will only choose the privilege feature. A list of privileges could be as follows:

• SeSecurityPrivilege
• SeTakeOwnershipPrivilege
• SeLoadDriverPrivilege
• SeBackupPrivilege
• SeRestorePrivilege
• SeDebugPrivilege
• SeSystemEnvironmentPrivilege
• SeImpersonatePrivilege

We store in the historical database all privileges ...