AI
Why Graphs Beat Tables for Incident Response
John Lambert from Microsoft tweeted in 2014: “defenders think in lists, attackers think in graphs, and as long as that is true, attackers win.” Tabular data is good for counting and searching what happened. It fails at showing how it happened and what connects to what. Graph queries replace multiple SQL joins with one descriptive line. Finding a three-hop path from one node takes one second on a CPU for a million edges. A T4 GPU handles 100 million edges in the same time. An H100 reaches 2 billion edges.
Building a Graph from NetFlow Logs
The speakers used a public dataset from the University of West Florida containing simulated attacks run with Metasploit. They extracted source IP, source port, destination IP, and destination port as the graph structure. Time became a property on each edge. The resulting graph contained 400,000 nodes and 500,000 edges. The raw visualization showed multiple clusters. The investigation started by isolating edges tagged with the MITRE ATT&CK exfiltration label using a GFQL query.
Reading the Exfiltration Subgraph
The exfiltration subgraph revealed only two IP addresses involved. The victim machine (blue) sent data to the attacker (red) using many different source ports. The attacker targeted only one port on the victim. A blast radius query from the compromised IP showed two ports on the victim: 4848 (GlassFish administration channel) and 445 (SMB). The attacker pulled credentials through port 4848 and exfiltrated data through port 445.
Animating the Attack Timeline
The speakers added time as an encoding and animated the graph over two weeks. The attacker hit port 4848 for a week, paused, then resumed. Port 445 activity appeared in bursts. The animation showed the attack progression in ten seconds. Applying the same port coloring to the full 400,000-node graph revealed red (445) and blue (4848) blobs across the entire network. Other machines were compromised but had not yet exfiltrated data. The single picture showed the active problem and the emerging one.
GPU Acceleration and Open-Source Tooling
The large graph rendered in five seconds on Graphistry using a GPU. The same graph in Gephi ran at low frame rate during preview. The speakers demonstrated the open-source Python library pygraphistry, installable via pip. It includes GPU-accelerated layout algorithms from cuGraph. UMAP clustering was shown as a method to reduce alert fatigue. The speakers used it to cluster 10,000 emails for an insider trading investigation, tagging 100 as relevant and focusing on clusters containing those tags.
Notable Quotes
“The biggest problem with network defense is that defenders think in lists, attackers think in graphs, and as long as that is true, attackers win.” Sindre Breda · ▶ Watch (4:14)
“One picture that says more than 2 million rows.” Sindre Breda · ▶ Watch (6:36)
“If you have a small data set, and small is … a million connections in your data set, so like a million edges, it’s not a problem doing that on your CPU. That takes a second to go three hops out.” Sindre Breda · ▶ Watch (9:30)
“You’d be surprised how long you can let it, you know, just vibe until it breaks and then you have to fix it.” Manfred Cheung · ▶ Watch (44:15)
Key Takeaways
- Graph queries replace multiple SQL joins with one descriptive line.
- A T4 GPU processes 100 million graph edges in sub-second time.
- Ports 4848 and 445 on one machine revealed a wider network compromise.
About the Speaker(s)
Sindre Breda started his career as a street cop who switched to computer forensics with a focus on online child abuse. From 2018 he worked at Kripos, the Norwegian National Criminal Investigation Service, where he analyzed data that commercial forensic toolkits did not parse. He worked on the 2019 Norsk Hydro ransomware investigation. He is now a Solutions architect at Graphistry.
Manfred Cheung is a visualization engineer at Graphistry with a background in graph visualization rendering. He was a core maintainer of CytoscapeJS and Grafer. He co-authored the Best Paper at IEEE VIS 2021 for graph approaches to large-scale biomedical knowledge exploration.