Collector: Building a Distributed Platform for Threat Intelligence

This will be both an in-person and online meeting.

Link to online meeting:

https://us06web.zoom.us/j/89410205410?pwd=RUFQM3JIT1kvblNpbmo0dktUaU9GUT09

6:00pm - 7:00pm -- Meet & Greet

7:00pm - 8:00pm -- Speaker Presentation

​8:00pm - 10:00pm -- After Party

Topic: Collector: Building a Distributed Platform for Threat Intelligence

Breach and malware-derived datasets can reveal interesting relationships between identities, accounts domains, and threat actors that are valuable for threat intelligence and security investigations. In this talk, I’ll cover Collector, the platform I built to acquire, catalog, and deduplicate these datasets from Telegram; the engineering challenges that pushed it from a simple downloader into a distributed system; and a few things I learned from analyzing the data.

​About the Speakers
Brian Scott is a security researcher with a background in offensive security, OSINT, and security engineering. He spends a lot of his time building infrastructure for threat intel research, and is a pathological data hoarder, which is how a seemingly reasonable idea like “I should automate downloading these files” turned into a distributed system managing several dozen terabytes of data. When he is not scraping dark-web forums for his collection, he can occasionally be found on street corners holding a sign that says "will work for SAS drives."