Data Science for DFIR - The Force Awakens

Conference: SANS DFIR Summit '20

Speaker: Jess Garcia - j3ssgarcia - Lead DFIR Analyst/CEO, One eSecurity

Title: Data Science for DFIR - The Force Awakens

Abstract:

Data Science (DS) and AI (Machine/Deep Learning) have effectively erupted in our world during the last few years, improving the efficiency of a vast number of areas and opening doors to new possibilities, both in the business front and our personal lives. The adoption of DS/IA in the DFIR field has been, however, modest so far.
During this presentation, Jess Garcia will introduce the different resources available in the DS/AI field, with a focus on the pythonic world (NumPy, Pandas, ScyPy, scikit-learn, Tensorflow/Keras, Matplotlib, …), and will show how to use these technologies to help in the parsing of DFIR data (timelines, event logs, forensic artifacts, memory objects, …), obtained with different triage or analysis tools (such as KAPE or volatility). Jess will also present how this techniques help other DFIR processes in the real world, such as Threat Hunting, by allowing to effectively process and analyze thousands of systems and big quantities of DFIR data.
Jess will also release some tools that will help to make use and get value from these technologies in a straightforward way.
To make the most of this presentation, learn before the Summit the most important DS/AI concepts at ds4n6.io

Downloads:

• Presentation (pdf): Here you can download the presentation document: Data Science for DFIR - The Force Awakens.
• Video: And here is the video recording.
• Post-conference Blog Post: This is just the start!