Open Source Summit + ELC Europe 2019

While intrusion detection systems are the basis of every security aware organization and most of the network based threats have been successfully mitigated in the past; it has a major drawback. And that is, the system is always one step behind the newest threats.

In depth analysis over a larger set of Network data has the advantage of detecting different types of anomalies. And if it is about a Largest Nation wide ISP, then the SOC team has to adopt the Anomaly Detection system to mitigate the infrastructure threats in a pro-active way.

This talk is about the research work to detect well known attacks in DNS infrastructure. And the years of experience has been deployed in to the system to build a robust Machine Learning model.

Mr. Shamim will share about the lesson learned with the conventional method that they have used and the Machine Learning approach that they have tested.

The final goal of this project is to produce ML based tools and share it to the community.