Large scale data analysis for system security

Certain phenoma do not manifest themselves on a small scale. For example, if you check the spam messages received by a single company you may not notice any pattern. But by looking at millions of spam messages collected worldwide, some structure can suddenly emerge and it may become possible to recognize spam campaigns, and even the infrastructure responsible for sending them. The same concept applies to many other security areas, from botnet detection to malware analysis, from web-based infection to network intrusion detection systems. In this talk, I will present some of the advantages of performing large scale analysis in the area of system security. In particular, I will describe several case studies, using results we obtained in the areas of embedded systems, online scam analysis, user risk profiling, and botnet detection as main running examples.