34:55This recording is not available yet.
Machine Learning applied to Threat Intelligence (ransomware)
Download resourcesCategories
About this session
Julie Brunias presents a personal side project, unrelated to her employer, that builds a machine-learning-ready ransomware dataset after finding that Canada's Centre for Cyber Security had no MITRE ATT&CK mapping for ransomware to offer. She scrapes and correlates blogs, forums and reverse-engineering write-ups from trusted sources (Talos, Picus, CISA, MITRE), manually deriving TTP codes when a source only describes behaviour in prose, and stores 218 mapped ransomware families, with 70-80 more queued, in a spreadsheet covering origin, targeted sectors, operating systems, code-reuse variants, commands and libraries, and ransom amounts. She explains why she rejected linear and logistic regression, SVMs, random forests, k-means, gradient boosting and Markov chains for this data, keeping two algorithms: Apriori for association rules between TTPs that recur together, and Monte Carlo simulation to rank which TTP clusters are most likely in future attacks. The dataset and scripts are published on GitHub. A long Q&A covers Monte Carlo calibration, filtering by targeted industry, dropping indicators of compromise for being too inconsistently formatted, and using the TTPs and command lists day to day in a SOC via Splunk exports and Purple Team exercises.
Cyber threats are evolving at an unprecedented pace, demanding smarter, faster defense mechanisms. Traditional methods often struggle to keep up with the sheer volume and complexity of modern attacks. That’s where machine learning transforms threat intelligence. In my presentation, I’ll showcase how I built a powerful tool leveraging a dataset I curated—applying ML to extract Tactics, Techniques, and Procedures (TTPs) and analyze command frequencies with precision. This approach uncovers attack patterns, enhances detection capabilities, and provides actionable insights that security teams can use to stay ahead. Whether you're a cybersecurity professional, data scientist, or enthusiast, this session will equip you with practical methods to harness ML for real-world threat intelligence. If you're ready to push the boundaries of cyber defense, this is where you want to be. Let’s dive into a future where AI-driven security is the key to proactive threat mitigation.
Key takeaways
- When a public source has no MITRE ATT&CK mapping, translate its prose description of ransomware behaviour into TTP codes yourself rather than skipping it; that manual step is what makes a dataset usable for a SOC.
- Don't force a machine learning algorithm onto data it doesn't fit: reject linear regression once values like ransom amounts fluctuate wildly by victim size, and drop clustering or classification methods when there is nothing meaningful to group or classify.
- Association-rule mining (Apriori) surfaces TTP combinations that recur together across ransomware families, useful for deciding what to test together in a Purple Team exercise instead of one technique at a time.
- Store the commands, APIs and libraries tied to each TTP, not just the TTP code itself, since a single ATT&CK technique can be implemented many different ways and a SOC needs to test coverage against all of them.
- Don't try to normalize indicators of compromise across sources if their formats are too inconsistent (URLs, checksums, etc.); focus effort on fields like TTPs and commands that can actually feed a SIEM.
Speakers
Julie Brunias
With 14 years of hands-on experience in cybersecurity, Julie is a seasoned cybersecurity consultant specializing in red teaming, penetration testing, data loss prevention (DLP), and evaluating the effectiveness of security tools. Over the years, she… Read moreRead less
With 14 years of hands-on experience in cybersecurity, Julie is a seasoned cybersecurity consultant specializing in red teaming, penetration testing, data loss prevention (DLP), and evaluating the effectiveness of security tools. Over the years, she has helped numerous organizations identify vulnerabilities and proactively strengthen their defences before threats emerge. Passionate about innovation, Julie is particularly enthusiastic about using cutting-edge technologies such as machine learning and artificial intelligence to automate workflows, enhance threat intelligence, and improve sandboxing-based detection of tactics, techniques, and procedures (TTPs). By streamlining processes and eliminating repetitive tasks, she enables teams to focus on strategic security priorities. Whether conducting complex security assessments or advising clients on emerging threats, Julie brings a deep technical understanding and a forward-thinking mindset to every project. Committed to staying ahead in a rapidly evolving threat landscape, she continues to explore new ways to combine advanced technologies with cybersecurity best practices to deliver effective, scalable solutions.
