Cyber security threats have been growing significantly in both volume and sophistication over the past decade. Naturally, this has also been accompanied by an increasing collection of threat telemetry data, ranging from detonation timelines to IDS/IPS detections just to name a few. Telemetry data, typically represented by enriched time series, often contains underlying peak signals which in turn correspond to a number of informative events: occurrences of malware campaigns, most adopted malware delivery vectors, commonly affected verticals, and even anomalies possibly revealing the presence of false positives. While all this information clearly holds tremendous value, mining such data sets is expensive and complex; as a result, organizations often find it challenging to gain further insights of the underlying threat landscape even though they have access to the data.

In this talk, we discuss Peak Analyzer, a new statistical approach to leverage telemetry data and automatically produce threat intelligence insights. By looking at telemetry data as a collection of multi-attribute time series, we translate outliers into meaningful signals. False positives are minimized by computing and comparing statistics from both local and global temporal windows; the approach is efficient and scalable thanks to a sliding window mechanism that keeps both sets of statistics up-to-date by relying on incremental updates. We conclude the talk by evaluating the effectiveness of our approach by showcasing the most recent malware campaigns detected by Peak Analyzer when processing threat telemetry data from our production network sensors.