Customers have several options of architecting recommendation engines, and a graphdb is the best way to create a real-time recommendation engine. I will use the as-yet unreleased Neptune service and will show a demo.In this session, we will look at approaches to use machine learning and graph representations for Cyber Investigative Analytics. We will give a demonstration of Graphistry using Amazon Neptune and a graph-based approach to detecting anomalies in Netflow data.

1. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AWS re:INVENT
Graph-Based Approaches for Cyber
Investigative Analytics
U s i n g G P U A c c e l e r a t e d C o m m u n i t y D e t e c t i o n a n d
V i s u a l i z a t i o n w i t h A m a z o n N e p t u n e a n d G r a p h i s t r y
B r a d B e b e e , A W S , P r i n c i p a l P M
L e o M e y e r o v i c h , G r a p h i s t r y , I n c . , C o - F o u n d e r & C E O
MCL342
November 30, 2017

2. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Agenda
• Scaling Interactive Investigations with Graphistry (GPU Demo)
• Amazon Neptune for Highly Connected Data
• Putting it all together: Netflow + Amazon Neptune + Graphistry
• GPU Demo

3. Graphistry Inc. 2017 info@graphistry.com
G R A P H I S T R Y
Scaling Investigations
with GPU Visual Graph Analytics Workflows
Leo Meyerovich, CEO
@LMeyerov

4. Graphistry Inc. 2017 info@graphistry.com
Today
Investigation
… A weird yet common problem
Graph are amazing
… Investigation analytics + the UI for ML
(Some of) Graphistry’s tech
… GPU client/cloud streaming, visual analytics playbooks, demos!
4

5. Graphistry Inc. 2017 info@graphistry.com
IP=10.16.0.8; msg=Spear phishing clicked;
time=2 Nov 2017 19:32:00 UTC; vendor=Blue Coat
5

6. Graphistry Inc. 2017 info@graphistry.com
6

7. Graphistry Inc. 2017 info@graphistry.com
7

8. Graphistry Inc. 2017 info@graphistry.com
5-100 tools, APIs, tables
10M - 1B events / day
Manually search
Manually link & repeat
Hope it’s not pool night
for your senior analysts
8

9. Graphistry Inc. 2017 info@graphistry.com
9

10. Graphistry Inc. 2017 info@graphistry.com
Can we turn 30min – 1 week into < 10min?
• Query for the right data
• Find the connections
• Make the right conclusions
• … repeat
è Appropriate actions
Amdahl’s Law:
Max improvement
constrained by slowest step
è need story on full
investigation process
10

11. Graphistry Inc. 2017 info@graphistry.com
How Graph Needs Cut Across Teams
Tier 1 Analysts
Tier 2 Analysts
[Sec/Net/Dev]Ops,
Hunters, & Researchers
11
Scale,
Interactivity
Urgency,
Automation
Map & zip through incidents
… + drill, pivot, & correlate
Audit more surface & tune scripts

12. Graphistry Inc. 2017 info@graphistry.com
This is the dirty reality behind many important things we don’t hear about
• Security SOC, IR, Hunting, & Intel
• Anti-Fraud: E-commerce, AML, …
• Gov: Anti-human trafficking, …
• Genomics & health records
• Big systems: NOC, DevOps, IOT, …
• Finance: Risk, Loans, …
12

13. Bring three 100X visual technologies
to unclog investigations:
Comprehend with
Graph, Clustering
Automate querying
with Visual Playbooks
Graphistry Inc. 2017
See 100X+ more results
with GPU Visual Analytics
info@graphistry.com
HDFS Splunk SQL API
OS logsDevice logs App logs Rule alerts AI alerts
Graphistry
interops w/
your infra
queries

14. Graphistry Inc. 2017 info@graphistry.com
Low-Dimensional: Lists, Pie Charts, Bar Charts, Heatmaps, …
??
> $ select * from ALERTS where PRIORITY > 8
srcIP dstIP alert score time
… … … … …
Page 1 … 99
14

15. Graphistry Inc. 2017 info@graphistry.com
Graphs = Maps for Data?
Show all events & entities involved, how they relate,
and enable people & computers to easily interact with them
15

16. Graphistry Inc. 2017 info@graphistry.com
Graphs Answer Tricky Questions
Progression & behavior
Patterns, correlations,
& outliers
Entities & scope
16

17. Graphistry Inc. 2017 info@graphistry.com
Intuition: All Entity & Event Correlations = Hypergraphs
alert1
url1
url2
url3
ip1
ip2
e1
e2
e2
17

18. Graphistry Inc. 2017 info@graphistry.com
Enterprise Trend: Graph = The Correlation Service
Prioritization
Days events è grouped incidents
Investigation
Click for context around an alert
Interactive ML without knowing any
Graph layouts = visual understanding &
manipulation of many clustering & inference
algorithms for high-dimensional data…!!!
18
…
è

19. Graphistry Inc. 2017 info@graphistry.com
GPUs Inside: Kernels Accelerate Every Component 10-1000X
19
Interactive Rendering
1+ million entities: 100X+ over D3.js
Meaningful Viz: Layout & ML
Smart clustering, coloring, sizing: 50X+ over Gephi
Interactive Analytics
Quickly drill down:
1 NVidia Tesla K80 = ~9 TFLOPS

20. Graphistry Inc. 2017 info@graphistry.com
100X Speedups:
We Make Your Device Span GPU Client + Cloud
20
Optimized networking
GPU analytics & vizGPU rendering
(No
JavaScript!)
GovCloud
20ms 50ms

21. Graphistry Inc. 2017 info@graphistry.com
To combine GPU analytics frameworks (… & in JavaScript!!)
… builders are standardizing on Arrow columnar file format
21
GRAPHISTRY BOX
In-house
GPU kernels
(nodejs app)
INPUT DATA
Spark, SQL,
Pandas, …
MapD
1. Arrow Input:
Ingest More Data, Faster
2. New: 3rd Party GPU
Analytics
data.arrow
pyGDF
…
data.arrow
(gpu pointer)

22. Graphistry Inc. 2017 info@graphistry.com
Arrow.js
Arrow.js:
From Node, use & combine GPU frameworks,
including GPU dataframes!
à Contact us to contribute!
22

23. Graphistry Inc. 2017 info@graphistry.com
GPU Visual Graph Analytics Workflows
Turn Investigation From 30min – 1 week into < 10min
• Query
• Connect
• Understand
• … Repeat
è Act
23

24. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Building Applications on Highly
Connected Data

25. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
• Understanding your networks requires
processing and analyzing extremely
large quantities of graph data in near-
real time.
• The domain of Cyber is about
networks, devices, and how they
interact.
• Graphs model nodes and links and how
they are connected.
G R A P H P A T T E R N M A T C H I N G A N D A N A L Y S I S A R E K E Y
E N A B L E R S F O R C Y B E R A N A L Y T I C S S U C H A S W I T H T R A F F I C
F L O W A N A L Y S I S .

26. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Challenges Building Apps with Highly Connected DRELATIONAL DATABASE CHALLENGES BUILDING
APPS WITH HIGHLY CONNECTED DATA
Unnatural for
querying graph
Inefficient
graph processing
Rigid schema inflexible
for changing data

27. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DIFFERENT APPROACHES FOR HIGHLY
CONNECTED DATA
Purpose-built for a business process
Purpose-built to answer questions about
relationships

28. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
A G RA PH DA T A BA SE IS OPT IMIZ E D F OR E F F ICIE NT
ST ORA G E A ND RE T RIE VA L OF H IG H L Y CONNE CT E D DA T A .

29. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AMAZON NEPTUNE
F u l l y m a n a g e d g r a p h d a t a b a s e
FAST RELIABLE OPEN
Query billions of
relationships with
millisecond latency
6 replicas of your data
across 3 Availability
Zones with full backup
and restore
Build powerful
queries easily with
Gremlin and SPARQL
Supports Apache
TinkerPop & W3C
RDF graph models
EASY

30. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NEPTUNE HIGH LEVEL ARCHITECTURE
Bulk load
from S3
Database
Mgmt.

31. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Putting it all together

32. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AN END-TO-END CONCEPT
http://vacommunity.org/VAST+Challenge+2013
Netflows
Graph Representation
Investigative Analytics
2 Weeks
14 M Netflows
1400 Devices

33. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
WITH A FEW IMPORTANT STEPS ALONG
THE WAY
VAST
2013
Netflows
Store
Amazon S3
Amazon EC2
P3 GPU
Amazon
Athena
AWS Glue
Model Transform
Detect
LoadInvestigate
2 Weeks
14 M Netflows
1400 Devices

34. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
NETFLOWS AS A GRAPH
https://resources.sei.cmu.edu/asset_files/Presentation/2015_017_001_431140.pdf

35. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
C O MMUNI T Y D E T E C T I O N A LGO R I T HM - A MA ZO N E C P3
Newman Spectral Modularity1
1. Modularity and community structure in networks, M. E. J. Newman, Proc. Natl. Acad. Sci. USA 103, 8577–8582 (2006).
Bij = Aij -
kikj
2m
Bij - Modularity matrix
Aij - Adjacency Matrix
ki - Degree of Vertex i in Aij
kj - Degree of Vertex j in Aij
m - Total number of edges in
graph
• Easily solvable by repeated application of
the power iteration method
• Provides generally good results compared
to other algorithms over a variety of
different types of data
• Can implement on the GPU using CUDA 9
and nvGraph’s SPMV operator

36. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
SUMMARIZING NETFLOWS WITH ATHENA INTO
AMAZON NEPTUNE CSV

37. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
DEMO

38. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
QUESTIONS

39. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
AMAZON NEPTUNE IS AVAILABLE FOR
PREVIEW
• Preview Sign-up
• https://pages.awscloud.com/NeptunePreview.html
• Amazon Neptune Web Page
• https://aws.amazon.com/neptune/
• Amazon Neptune Documentation
• https://docs.aws.amazon.com/neptune/latest/userguide/

40. Try Graphistry:
• Security and anti-fraud teams: Contact for a demo
• Developers and data scientists: Contact for an API Key
info@graphistry.com
G R A P H I S T R Y

41. © 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
Thank you!