Hacking Context for Auto Root Cause and Attack Flow Discovery
LLM-free alert contextualization and modular correlation pipeline to uncover root causes and attack flows in noisy IoT environments.
Summary
Alert Noise in IoT Environments
IoT environments generate massive, noisy streams of logs and alerts, most of which lack the context required for effective detection and response. This presentation introduces an LLM-free approach to large-scale alert contextualization that operates without complex query authoring or heavy machine learning models.
Modular Correlation and Contextualization Logic
Lightweight, modular correlation logic automatically enriches logs, infers context, and groups related events across sensors, devices, and cloud services. By analyzing time, topology, and behavioral attributes, the system constructs causality sequences that explain what happened, where, and why without relying on human-crafted rules or expensive AI inference.
Practical Deployment
The approach provides practical techniques and open-source tools for deploying contextualization pipelines in resource-constrained IoT, industrial OT networks, smart home environments, and edge devices.
Related talks
NorthSec·33 min
Industry experts analyze emerging threats surrounding NSEC2023 - IaC, Automation, and Testing: The Key to Unlocking the Power of Detection Engineering.
Creator Stage·26 min
Brandon Bailey
Applies offensive techniques from the SPARTA framework to generate behavioral indicators (IoBs) and design realistic intrusion detection systems for spacecraft.
Creator Stage·43 min
Josh Pyorre
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.