SecAppDev 2017

Many tasks in computer security revolve around the manual analysis of data, such as the inspection of log files or network traffic. Data mining and machine learning can help to accelerate these tasks and provides versatile tools for detecting and analyzing security data. The sesions deals with the combination of machine learning and computer security. After a short introduction to the basics of machine learning, we present common learning concepts and discuss how they are applied to security problems, such as intrusion detection, malware analysis or vulnerability discovery.

A common application of data mining in security is the detection of attacks. Learning methods can often generate detection models that are competitive with manually crafted patterns and reduce the manual effort of analyzing attack data. In this session, we present learning-based detection approaches. We discuss the underlying learning concepts, namely classification and anomaly detection, and look at some practical examples. We close this discussion by pointing at novel problems, such as poisoning and evasion attacks against machine learning.