Machine Learning in Cybersecurity: Clustering for Threat Detection

Author Credits: Alvin Wen, Software Architect, and Craig Chamberlain, Director of Algorithmic Threat Detection

Many modern standards, practices, and frameworks, including the MITRE ATT&CK matrix, emphasize the importance of discerning the unusual from the malicious in modern event logs and detections, which often contain many shades of gray between the interesting and the confirmed true positive threat detection. 

The MITRE ATT&CK matrix makes extensive recommendations to “baseline” normal activity. It contains at least 154 references to baselining normal activity, …

amp architect att author clustering cybersecurity detection detections director event event logs frameworks logs machine machine learning malicious matrix mitre mitre att&amp practices shades of gray software standards threat threat detection