All Apps and Add-ons

Machine Learning Toolkit: Has anyone used this app with data exfiltration?

mcbradford
Contributor

Hello,

Not sure if anyone has used the Machine Learning Toolkit for data exfiltration (data exfil)? I would like to identify outliers from my email traffic. I have the message size within my data, so I was hoping to use this data to establish a baseline and alert on the outliers. Any thoughts on doing this with Splunk and/or the Machine Learning Toolkit?

0 Karma
1 Solution

rjthibod
Champion

I have not used it for this purpose, but using the Median Absolute Deviation algorithm (MAD) under the Outlier Detection set of tools might prove useful.

MAD is more robust than using something like standard deviation, in part because it does not rely on a normal distribution assumption.

The tricky thing you would need to figure out is how to setup the model via fit in order to determine your thresholds based on certain message types or metadata (e.g., source, sender, etc.). Once you decide on what dimensions are important to differentiate message types, it should be pretty shortforward to use the toolkit to set the parameters for the populations and then setup some saved searches that would use apply.

View solution in original post

0 Karma

rjthibod
Champion

I have not used it for this purpose, but using the Median Absolute Deviation algorithm (MAD) under the Outlier Detection set of tools might prove useful.

MAD is more robust than using something like standard deviation, in part because it does not rely on a normal distribution assumption.

The tricky thing you would need to figure out is how to setup the model via fit in order to determine your thresholds based on certain message types or metadata (e.g., source, sender, etc.). Once you decide on what dimensions are important to differentiate message types, it should be pretty shortforward to use the toolkit to set the parameters for the populations and then setup some saved searches that would use apply.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...