Using Language Modeling to Verify User Identities

USING LANGUAGE MODELING
TO VERIFY USER IDENTITIES
Chris Poirel
Data Scientist
BlackHat USA | August 2018
Copyright © 2018 Forcepoint.
Eduardo Luiggi
Data Scientist

Copyright © 2018 Forcepoint. | 2
Problem statement
Overview of Language Modeling
Data sets and data preparation
Case studies
OUTLINE

USER AND ENTITY BEHAVIOR ANALYTICS
UEBA focuses on identifying
entities and assessing their risk to
an organization
Effort to recognize/prevent compromised
accounts, malicious activity, IP theft, etc.
Routinely investigating novel techniques
to extract additional analytic value from
existing data sources
Data challenges
Lack of "gold standard" data sets to
support traditional supervised ML
Increasing volume collected about the
entity – often requires pre-filtering or
"sessionizing" event sets
Requires highly accurate entity resolution
(e.g., email, IP, MAC, username)
Need to integrate and understand
structured vs. unstructured data

DEFINING MACHINE LEARNING
"Any computer program that improves performance at some task through experience."
"A computer program is said to learn from experience E with respect to some class of
tasks T and performance measure P, if its performance at tasks in T, as measured by P,
improves with experience E." - Tom Mitchell
In order to build an effective ML-based solution, we should clearly define…
The task we're trying to improve
Entity identificaiton
A method for measuring the performance of the solution
Quantitatively by defining true positives / negatives and assessing precision
The experiences we're using to improve performance
Unstructured content generated by the entity over time

IMPROVE ENTITY IDENTIFICATION
How can we improve entity
detection from unstructured,
human-generated content?
Reliably identify an individual from the
content of their email
Predict if a user's account has been
compromised based on
their language
Extend the same approaches
to "less structured" data like command
line activity

IMPROVE ENTITY IDENTIFICATION
Can we make use of advances in Language
Modeling to address these concerns?
A variety of biometrics have been used for verifying
user identities, including fingerprinting, facial
recognition, and keystroke analysis
NLP research has found that people's use of
language can also be uniquely identifying
Language modeling is a technique for measuring
how likely words and phrases are, given some
observations about previous language use
LM is used heavily in speaker and author
identification, as well as speech recognition and
machine translation

UNSUPERVISED TO THE RESCUE?
Techniques for assigning probabilities to sentences or phrases
Captures some level of syntax and semantics
P("the dog runs") > P("the dogs runs")
P("the dog runs") > P("the tables run")
Applications
Speech recognition:
P("Sweet dreams are made of cheese")
< P("Sweet dreams are made of this")
Language identification
P("Donde está la biblioteca" | Spanish)
> P("Donde está la biblioteca" | English)
Context-sensitive spell checking
P("Football is their favorite sport")
> P("Football is there favorite sport")
Machine translation
Autocomplete

N-GRAM LANGUAGE MODELS
N-gram models estimate the probability of a word
given the words that come before it
P("The boy walked to the circus") = P(The) *
P(boy | The) *
P(walked | The boy) *
P(to | boy walked) * …
Word n-grams are contiguous collections of n words:
Unigram Bigram Trigram ...
The The boy The boy walked
boy boy walked boy walked to
walked walked to walked to the
to to the to the circus.

CHALLENGES BUILDING ML MODELS
Parameter tuning
Must determine an appropriate value for n,
how much history to include
Small values of n are easy to estimate and
are more likely to estimate the probability
of seeing terms in a general context
Large values are computationally more
burdensome and risk overfitting the model,
which fails to generalize well
Training corpus
Depends heavily on the application and
the problem you're trying to solve
Learning a model for the industry (tech),
organization (Enron vs. Avocado), or
each individual
Each may require a different amount of
training history or different corpora to
achieve acceptable accuracy

Prepare for the unknown
Must account for missing/incomplete data in the training corpus.
P("The boy walked to the circus") = P(walked | the boy) * … * P(circus | to the) = 0
Smoothing is a common technique applied to ML models when the universe of observations can never be
fully trained, so we must assume any observation can occur

Suppose we trained a unigram model on "The boy walked the dog"
Term Freq Prob Smoothed Freq Smoothed Prob
the 2 2/|W| = 0.4
boy 1 0.2
walked 1 0.2
dog 1 0.2
circus 0 0
TOTAL |C| = 5 1.0

Suppose we trained a unigram model on "The boy walked the dog"
Laplace Smoothing helps solve this problem – there are numerous other smoothing techniques
Term Freq Prob Smoothed Freq Smoothed Prob
the 2 2/|W| = 0.4 2+1 3 / (|C| + |V|)
boy 1 0.2 1+1 2 / (|C| + |V|)
walked 1 0.2 1+1 2 / (|C| + |V|)
dog 1 0.2 1+1 2 / (|C| + |V|)
circus 0 0 1 1 / (|C| + |V|)
TOTAL |C| = 5 1.0 |C| + |V| 1.0

TEST DATASETS
Enron Corporation Corpus
~500k emails from
~150 internal employees
Heavily used in NLP and social-
networking research with several sources
of manual annotation
Significant amount of sensitive material
was removed before releasing to the
public, along with several redactions for
privacy concerns
Freely publicly available
Avocado Collection
~1M emails from 280 employees of
a defunct IT company fictitiously
named Avocado
Includes attachments, contact lists,
calendars from those employees'
personal folders
All data has been de-identified
Requires license

DATA CLEANUP: PRE-PROCESSING ANALYTICS
Analytics of
unstructured data can
be particularly
difficult due to corpus
inconsistencies,
missing data, and
biased view (internal
sender/recipient only)
This process is
usually messy and
requires multiple
iterations
Need to focus on
analyzing relevant
text introduced by
the sender

DATA CLEANUP: PRE-PROCESSING ANALYTICS
A few things we've
done to hone in on
personalized text:
Address various format issues – Strip extraneous markup (e.g., html,xml), header
info, and terse text blocks with no discernible human content
Noise filtering – Heuristics to identify bulk senders and exclude those mailboxes
from further analysis
Disclaimer detection – N-gram and bag of words models to classify paragraphs
as disclaimer text and exclude from personalized language models
Thread email
Remove signature blocks

LANGUAGE MODELING FOR USER IDENTIFICATION
Given a new block of unstructured content, can we …
Learn organizational language models to differentiate Enron vs. Avocado?
Learn personalized language models for individuals in each corpus?
Apply the same techniques to nontraditional "less structured" content?
The ability to address any of these and generalize
the techniques across industries can drastically
improve our ability to predict unusual activity.

LEARNING A LANGUAGE MODEL
Select sent emails from top-N senders in each of the datasets
12 entities/corpus
Each entity has between ~1000 and ~9000 sent emails
Not every email contributes to the model, e.g., forwarded emails are discarded
For each entity
Split their email set in training (~80%) and testing datasets (~20%)
Use KenLM Language Model Toolkit (https://kheafield.com/code/kenlm/)
to learn an n-gram language model on training dataset
Uses Kneser-Ney smoothing

CASE STUDY: ORGANIZATIONAL LANGUAGE MODELS
Types: 64370
Unigram tokens: 3950539
Types: 28937
Unigram tokens: 943170
Enron
Avocado

CASE STUDY: ORGANIZATIONAL LANGUAGE MODELS
Surprising?
Not really
What are the models learning?
Avocado Enron
please please
file power
application agreement
avocadoit enron
wireless attached
output state
activityname want
new new
Among top-25 terms

CASE STUDY: PERSONALIZED MODELS (AVOCADO)

CASE STUDY: PERSONALIZED MODELS (ENRON)

HOW MUCH DATA DO WE NEED?
Changed the size of training
samples
0.01, 0.05, 0.10, 0.25, 0.50, 0.75, 1.0
Constant test size
Observations
With a small training sample we
predicted the model with the most
tokens most of the time

samples
0.01, 0.05, 0.10, 0.25, 0.50, 0.75, 1.0
Constant test size
Observations

samples
0.01, 0.05, 0.10, 0.25, 0.50, 0.75, 1.0
Constant test size
Observations
Enron dataset is ~50% the size of
Avocado
Enron modeling performance is similar to Avocado @
50%

samples
0.01, 0.05, 0.10, 0.25, 0.50, 0.75, 1.0
Constant test size
Observations
Avocado
• Enron modeling performance is similar to Avocado @
50%

samples
0.01, 0.05, 0.10, 0.25, 0.50, 0.75, 1.0
Constant test size
Observations
Avocado
Enron modeling performance is similar to Avocado @
50%

SOMETIMES MODELS ARE JUST BAD
Jeff Dasovich
Second largest training set from Enron
Most unique tokens
We are more likely to guess Richard Sanders
as the author
Common top-25 tokens include
'know', 'like', 'call', 'get', 'time', 'would', 'thanks'
Why do we fail to identify Jeff?

SOMETIMES MODELS ARE JUST BAD
Jeff Dasovich
Second largest training set from Enron
Most unique tokens
We are more likely to guess Richard Sanders
as the author
Common top-25 tokens include
'know', 'like', 'call', 'get', 'time', 'would', 'thanks'
Why do we fail to identify Jeff?
He liked to embed news articles in his emails
… This article showed up on Wednesday . Thought
you might be interested .
Texas Journal -- Energy traders cite gains , but some
math is missing -- Volatile prices for natural gas and
electricity are creating high-voltage counting on these
gains could be in for a jolt down the road ...

EXTENDING TO OTHER
STRUCTURED CONTENT
Demonstrated a solution that
Addresses the task of entity identification
Increases performance according to
quantitative precision assessment
Improves performance over time with
additional experience
Potential future applications
Chat or phone transcript
Command line activity
Database / SIEM queries

Using Language Modeling to Verify User Identities

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Similar a Using Language Modeling to Verify User Identities

Similar a Using Language Modeling to Verify User Identities (20)

Más de Forcepoint LLC

Más de Forcepoint LLC (19)

Último

Último (20)

Using Language Modeling to Verify User Identities

Notas del editor