Book Image

Mastering Machine Learning for Penetration Testing

By : Chiheb Chebbi
Book Image

Mastering Machine Learning for Penetration Testing

By: Chiheb Chebbi

Overview of this book

Cyber security is crucial for both businesses and individuals. As systems are getting smarter, we now see machine learning interrupting computer security. With the adoption of machine learning in upcoming security products, it’s important for pentesters and security researchers to understand how these systems work, and to breach them for testing purposes. This book begins with the basics of machine learning and the algorithms used to build robust systems. Once you’ve gained a fair understanding of how security products leverage machine learning, you'll dive into the core concepts of breaching such systems. Through practical use cases, you’ll see how to find loopholes and surpass a self-learning security system. As you make your way through the chapters, you’ll focus on topics such as network intrusion detection and AV and IDS evasion. We’ll also cover the best practices when identifying ambiguities, and extensive techniques to breach an intelligent system. By the end of this book, you will be well-versed with identifying loopholes in a self-learning security system and will be able to efficiently breach a machine learning system.

Related Content you might be interested in

Current Title:

Small book image
Mastering Machine Learning for Penetration Testing
Chiheb Chebbi
Jun, 2018 | 276 pages
Small book image
Hands-On Artificial Intelligence for Cybersecurity
Alessandro Parisi
Aug, 2019 | 342 pages
Small book image
Hands-On Machine Learning for Cybersecurity
Soma Halder | Sinan Ozdemir
Dec, 2018 | 318 pages
Small book image
Machine Learning for Cybersecurity Cookbook
Emmanuel Tsukerman
Nov, 2019 | 346 pages
Table of Contents (13 chapters)
Preface
Preface
Who this book is for
What this book covers
To get the most out of this book
Get in touch
Free Chapter
1
Introduction to Machine Learning in Pentesting
Introduction to Machine Learning in Pentesting
Technical requirements
Artificial intelligence and machine learning
Machine learning development environments and Python libraries
Machine learning in penetration testing - promises and challenges
Summary
Questions
Further reading
2
Phishing Domain Detection
Phishing Domain Detection
Technical requirements
Social engineering overview
Steps of social engineering penetration testing
Building real-time phishing attack detectors using different machine learning models
NLP in-depth overview
Summary
Questions
3
Malware Detection with API Calls and PE Headers
Malware Detection with API Calls and PE Headers
Technical requirements
Malware overview
Machine learning malware detection using PE headers
Machine learning malware detection using API calls
Summary
Questions
Further reading
4
Malware Detection with Deep Learning
Malware Detection with Deep Learning
Technical requirements
Artificial neural network overview
Implementing neural networks in Python
Deep learning model using PE headers
Deep learning model with convolutional neural networks and malware visualization
Promises and challenges in applying deep learning to malware detection
Summary
Questions
Further reading
5
Botnet Detection with Machine Learning
Botnet Detection with Machine Learning
Technical requirements
Botnet overview
Building a botnet detector model with multiple machine learning techniques
How to build a Twitter bot detector
Summary
Questions
Further reading
6
Machine Learning in Anomaly Detection Systems
Machine Learning in Anomaly Detection Systems
Technical requirements
An overview of anomaly detection techniques
Network attacks taxonomy
The detection of network anomalies
Building your own IDS
The Kale stack
Summary
Questions
Further reading
7
Detecting Advanced Persistent Threats
Detecting Advanced Persistent Threats
Technical requirements
Threats and risk analysis
Threat-hunting methodology
Threat hunting with the ELK Stack
Summary
Questions
8
Evading Intrusion Detection Systems
Evading Intrusion Detection Systems
Technical requirements
Adversarial machine learning algorithms
Evading intrusion detection systems with adversarial network systems
Summary
Questions
Further reading
9
Bypassing Machine Learning Malware Detectors
Bypassing Machine Learning Malware Detectors
Technical requirements
Adversarial deep learning
Bypassing next generation malware detectors with generative adversarial networks
MalGAN
Bypassing machine learning with reinforcement learning
Summary
Questions
Further reading
10
Best Practices for Machine Learning and Feature Engineering
Best Practices for Machine Learning and Feature Engineering
Technical requirements
Feature engineering in machine learning
Feature selection algorithms
Best practices for machine learning
Summary
Questions
Further reading
11
Assessments
Assessments
Chapter 1 – Introduction to Machine Learning in Pentesting
Chapter 2 – Phishing Domain Detection
Chapter 3 – Malware Detection with API Calls and PE Headers
Chapter 4 – Malware Detection with Deep Learning
Chapter 5 – Botnet Detection with Machine Learning
Chapter 6 – Machine Learning in Anomaly Detection Systems
Chapter 7 – Detecting Advanced Persistent Threats
Chapter 8 – Evading Intrusion Detection Systems with Adversarial Machine Learning
Chapter 9 – Bypass Machine Learning Malware Detectors
Chapter 10 – Best Practices for Machine Learning and Feature Engineering
12
Other Books You May Enjoy
Other Books You May Enjoy
Leave a review - let other readers know what you think

Threat hunting with the ELK Stack

You have now seen a clear overview of the most important terminologies in threat hunting. So, let's build our threat-hunting platform. In the following sections, we will learn how to build a threat-hunting system by using open-source projects. In our hands-on guide, we will use one of the most promising solutions available—the ELK Stack. It includes three open-source projects, and is one of the most downloaded log management platforms nowadays.

The ELK Stack is widely used in many fields, including:

  • Business intelligence
  • Web analytics
  • Information security
  • Compliance

The ELK Stack is composed of the following components:

  • Elasticsearch: To search and analyze data
  • Logstash: To collect and transform data
  • Kibana: To visualize data

The following diagram illustrates the major components in the ELK Stack:

So, according to the main architecture...

Previous Section
End of Section 5
Next Section