Juniper Networks, Inc. offers hardware products and software services to its enterprise customers. Due to the nature of it's business, Juniper Networks, Inc. is deeply invested in providing the best customer support and as part of the support automation team, our goal is to optimize the company's efforts towards it. For this purpose, alongside other initiatives, we leverage deep learning based sequence to sequence models wherever we see fit. In this paper, we discuss two such models: a conversational chatbot to help answer some technical questions for our customers, and a text summarizer to condense the large text in our support tickets and other articles. These two models are designed using bi-directional recurrent neural network (Bi-RNN) architectures for content understanding and were customized to fit the domain-specific nature of our data. First, we discuss our efforts towards data preparation. Then, we explain our model design, customization and evaluation mechanisms. Finally, we provide the preliminary results and share the potential impact our models will have on our business. Our initial results have BLEU score of 0.21 for text summarizer which is 16% better than our baseline model. Our chatbot passed the eye-tests of our subject matter experts.

In big data systems, the infrastructure is such that large amounts of data are hosted away from the users. In such a system information security is considered as a major challenge. From a customer perspective, one of the big risks in adopting big data systems is in trusting the provider who designs and owns the infrastructure from accessing user data. Yet there does not exist much in the literature on detection of insider attacks. In this work, we propose a new system architecture in which insider attacks can be detected by utilizing the replication of data on various nodes in the system. The proposed system uses a two-step attack detection algorithm and a secure communication protocol to analyze processes executing in the system. The first step involves the construction of control instruction sequences for each process in the system. The second step involves the matching of these instruction sequences among the replica nodes. Initial experiments on real-world hadoop and spark tests show that the proposed system needs to consider only 20 percent of the code to analyze a program and incurs 3.28 percent time overhead. The proposed security system can be implemented and built for any big data system due to its extrinsic workflow.

Big data platforms like Hadoop and Spark are being widely adopted both by academia and industry. In this paper, we propose a runtime intrusion detection technique that understands and works according to the memory properties of such distributed compute platforms. The proposed method is based on runtime analysis of memory access patterns of tasks running on the slave nodes of a distributed compute cluster. First, every slave node of the cluster creates a behavior profile for each task it executes. A behavior profile includes information representing the sizes of private & shared memory accesses made by a task during execution. Then, each process behavior profile is shared with other replica nodes that are scheduled to execute the same task on their copy of the same data. Next, these replica nodes verify their local tasks with the help of the information embedded in the received behavior profiles. This step is realized by running Principal Component Analysis (PCA) on the memory access patterns. Finally, nodes share their observations for consensus and report a possible intrusion to the master node if they find any discrepancy. This is a position paper and hence the proposed solution was tested and proved to work in real-time while executing the terasort mapreduce example on a small hadoop cluster.

Cyber attacks are becoming a threat to the proliferation of big data services. Security in big data services is primarily implemented through software that is maintained by service providers which makes it easier for insider attacks. In this paper, we introduce a novel hardware driven framework for mitigating insider attacks in big data systems. The key idea is to delegate security to special purpose hardware that is capable of detecting an attack on the primary copy of data and preventing that attack on the replicas. In the proposed framework, the assembly code of a process running on the primary copy is analyzed and an attack probability score (APS) is derived which captures in some sense the control structure of the code. The APS of a process is unique to the structure of that process and is derived from the control-flow instructions and their data (if applicable). This score along with the control and data stacks are maintained in the replica nodes. Now, at the replica nodes when the same code is executed, the APS is computed dynamically on the fly and matched with the stored APS. If there is a mismatch indicating a possible attack, the control and data flow stacks are matched in sequence to detect attacks. Our proposed framework was simulated on a virtual cluster and verified using open benchmarks. Experimental results prove that our framework can be implemented with negligible time overhead. Results indicate that the average time overhead is about 0.01% of the total execution time.