AI
Singing Through Dead Air: Why Isolated Alerts Miss the Attack
Equifax had all the security tools. It still lost 147 million records over 76 days. Attackers sat inside for 76 days, moved through 51 databases step by step. The tools caught individual events — a failed login, a file access — but never connected them. Day 1, Day 41, Day 75 alerts sat as snapshots. Sneha Rangari framed the gap: isolated notes sound harmless. A login at 3 AM, a bulk API export, a privilege escalation — each passes as normal. The sequence tells the story. The tools were listening to notes, not the composition.
Mapping Events to Music: Notes, Motives, and Dissonance
Every security event becomes a note. Combine notes into bars — sequences that reveal an attacker’s motive. A motive is a recurring pattern, the way credentials are reused or how hops happen between networks. Harmonic dissonance flags events that don’t fit the context: a login at a weird time not followed by an admin update. Transformative attention keeps the full memory across a long timeline. The model then predicts the next likely action before it happens. The engine works as a pre-correlation layer, augmenting existing SIEMs without replacing them.
Case Study: Lateral Movement Caught 11 Minutes Earlier
A non-user logs in, generates a service token, runs remote execution on a new host, then escalates privilege within 3 minutes. Each step in isolation is low-priority. The music-sequence model sees the entire progression and sounds a structural dissonance alert. It flagged this 11 minutes before the rule-based correlation engine. Eleven minutes means containing one host instead of investigating five. The alert gives the analyst the full sequence — login, token, remote exec, escalation — not just a score. Reduced fatigue, early detection, explainability.
Case Study: Shadow SaaS Exfiltration Stopped Before Data Leaves
Attackers use unsanctioned SaaS apps to blend in as normal users. A valid OAuth token is issued. Then a bulk API export skips the typical email-checking workflow. Sequential access to sensitive folders follows, all happening at 3 AM from a new IP. The sequence model catches the rhythm shift before data exits the system. It alerts on the full progression — token, bulk API, folder access — and the context (time, IP). The composition was broken before exfiltration completed.
Results and Lessons
Compared against traditional rule-based engines, the music-sequence model improved precision by 15% and reduced false positives by 22%. The 11-minute early detection on lateral movement came from scoring structural progression rather than waiting for a known signature to complete. Three lessons: static signatures are brittle, context is the signal not the individual action, and the system filters harmony by correlating what makes sense. Future work includes identity-centric scoring, cross-environment orchestration (cloud, SaaS, endpoint), and community experimentation.
Q&A
How does the model connect events when there are large gaps, like in low-and-slow attacks? The model builds sequences per identity. When a new event occurs after a gap, it checks the past sequence for that identity and correlates the previous A+B with C, so long pauses are covered. ▶ 28:31
Notable Quotes
“attackers don’t operate in notes. They operate in sequences.” Sneha Rangari · ▶ 0:54
“louder does not mean clearer.” Krupa Brahmkstri · ▶ 26:34
“if we could have connected all the dots, we could have got the solution and we could have prevented it.” Krupa Brahmkstri · ▶ 28:57
Key Takeaways
- Modeling events as sequences catches attacks that individual alerts miss.
- The system detected lateral movement 11 minutes earlier than rule-based correlation.
- Precision improved 15% and false positives dropped 22% in production tests.
About the Speaker(s)
Krupa Pratap Brahmkstri is a Sr. Consultant-level Data Scientist with over a decade of experience delivering data-driven solutions that span across industries, including cybersecurity and AI. She specializes in building end-to-end machine learning solutions, from problem definition…
Sneha Rangari is a Cybersecurity Professional with over 7 years of experience in Security Engineering, Security Architecture, Security Assessment focusing on AI/ML, Third party Vendor applications, Cloud applications and Technology Risk Management. She is CISSP and GMLE certified and currently…