By Jay Jacobs (@jayjacobs) and Bob Rudis (@hrbrmstr)
Fri 31 January 2014 | tags: book, -- (permalink)

It looks like we overlooked (yesterday) that Data-Driven Security (the book) is also available as a Nook book now (not pre-order).

And, to avoid another e-book shameless self-promotion post, it looks like you can also get it now for your Kobo Reader.

A huge “thank you” to everyone for their ...

By Jay Jacobs (@jayjacobs) and Bob Rudis (@hrbrmstr)
Thu 30 January 2014 | tags: book, -- (permalink)

While Data-Driven Security (The Book) is still in pre-order on many retailers, you can sneak an advance copy of it by heading over to Google Books or Google Play. Despite Google “knowing all”, we can assure you that Jay is not “a journalist and food critic.” Remember, the official launch ...

By Bob Rudis (@hrbrmstr)
Sun 26 January 2014 | tags: podcast, -- (permalink)

Episode 2 of the Data Driven Security Podcast is live on the site/should be in the feeds and ready for your media consumption.

By Bob Rudis (@hrbrmstr)
Sat 25 January 2014 | tags: data science, podcast, -- (permalink)

I had the opportunity to attend Weathering the Data Storm: The Promise and Challenges of Data Science at Harvard yesterday (2013-01-24). Overall, it was an excellent symposium and I’ll be talking with ...

By Jay Jacobs (@jayjacobs)
Thu 23 January 2014 | tags: EDA, analysis, honeypot, R, -- (permalink)

This is part 2 of a series (visit part 1). I will be looking at destination ports in this post.

Bob and I spent quite a bit of time early on in the book showing what we can learn from IP addresses. But let’s ...

By Bob Rudis (@hrbrmstr)
Tue 21 January 2014 | tags: maps, d3, map, cartography, -- (permalink)

(This series of posts expands on a topic presented in Chapter 5 of Data Driven Security : The Book)

Cartographers (map makers) and infosec professionals both have the unenviable task of figuring out the best way to communite complexity to a diverse audience. Maps hold an unwarranted place of privilege in ...

By Bob Rudis (@hrbrmstr)
Sat 18 January 2014 | tags: shiny, R, -- (permalink)

An innocent thread on the SIRA mailing list begat a detailed explanation by Jay which begat a comment with a link to a gist by David Severski that had an equally innocent comment:

# extending to UI framework of your choice is left as an exercise for the reader

(see Jay ...

By Jay Jacobs (@jayjacobs)
Fri 17 January 2014 | tags: simluation, R, -- (permalink)

A few years ago I worked on an excel plugin (to support risk analysis) called OpenPERT with Chris Hayes. The entire point of this plugin was to brig the betaPERT distribution into excel because there is no native support for it. OpenPERT accomplishes this quite ...

By Jay Jacobs (@jayjacobs)
Thu 16 January 2014 | tags: EDA, analysis, honeypot, R, -- (permalink)

I like honeypots. Not so much for what they show about individual attackers, but for what they can show about the trends across attackers. I’ve struggled to get good honeypot data though, so if anyone has access to data (or people with data) and ...

By Bob Rudis (@hrbrmstr)
Thu 16 January 2014 | tags: python, R, -- (permalink)

Readers of the data exploration in R post will have noticed the use of Python for the extraction of TLD components of malware domain names. The excerpt in question is below:

write.table(str_extract(mdl.df$domain, perl("^[a-zA-Z0-9\\-\\._]+")),
            file="/tmp/indomains.txt",
            quote=FALSE,
            col.names=FALSE,
            row ...