Conference: SANS DFIR Summit '20
Title: Data Science for DFIR - The Force Awakens
Data Science (DS) and AI (Machine/Deep Learning) have effectively erupted in our world during the last few years, improving the efficiency of a vast number of areas and opening doors to new possibilities, both in the business front and our personal lives. The adoption of DS/IA in the DFIR field has been, however, modest so far.
During this presentation, Jess Garcia will introduce the different resources available in the DS/AI field, with a focus on the pythonic world (NumPy, Pandas, ScyPy, scikit-learn, Tensorflow/Keras, Matplotlib, …), and will show how to use these technologies to help in the parsing of DFIR data (timelines, event logs, forensic artifacts, memory objects, …), obtained with different triage or analysis tools (such as KAPE or volatility). Jess will also present how this techniques help other DFIR processes in the real world, such as Threat Hunting, by allowing to effectively process and analyze thousands of systems and big quantities of DFIR data.
Jess will also release some tools that will help to make use and get value from these technologies in a straightforward way.
To make the most of this presentation, learn before the Summit the most important DS/AI concepts at ds4n6.io