Juli 31, 2018

How Machine Learning is Improving Cyber Security

Based on the disturbing number of successful data breaches over the past few years, it’s pretty evident that companies are being overwhelmed by the increasing number of cyber threats.

However, a new breed of solution in the case of cyber threat has sprung up, offering to apply machine learning to enterprise security stronger. These tools deliver the ability to analyze networks, learn about them, detect anomalies and protect enterprises from threats.

Machine learning is the answer to today’s cyber security challenges. Machine learning algorithms essentially build models of behaviors and use those models as a basis for making future predictions based on newly input data.

Importance of Machine Learning in Cyber Security:

1) Because hackers are consistently building upon older threats – including new abilities or tweaking previously used samples to build out a malware family – utilizing machine learning systems to look out for and provide notification of emerging attacks could be incredibly beneficial.

2) Data deception technology products by machine learning can automatically detect, analyze and defend against advanced attacks by proactively detecting and tricking attackers. So, when we combine very smart security personnel with adaptive technology that continues to change and become smarter over time, this provides a competitive edge to defenders that have primarily been absent from most cybersecurity technologies to date.

3) Machine learning will make sense of the security threats our organization faces and help our staff focus on more valuable and strategic tasks.

Machine Learning in Improving Cyber Security

Monitoring and responding to suspicious traffic: One way machine learning can be used to improve cybersecurity is by monitoring network traffic and learning the norms of a system. A well-trained machine learning model will be able to spot atypical traffic within a network and quarantine an anomaly. Most machine algorithms typically send an alert to a human analyst to determine how to respond to a threat; however, some machine learning algorithms are able to act on their own accord, such as thwarting certain users from accessing a network.

Automating repetitive tasks: Another way machine learning can help propel cybersecurity is by automating several repetitive tasks. For example, during a data security breach, an analyst has to juggle multiple responsibilities, including determining what was exactly stolen, how it was taken and fixing the network to stop similar future attacks. With machine learning, many of these tasks can be automatically deployed, significantly reducing the amount of time it takes to fix the vulnerability in return.

Complementing human analysis: Machine learning can also be used to complement human analysis. For example, in a paper published in 2016, MIT and PatternEx researchers demonstrated an A.I. platform could predict cyber attacks significantly better than existing systems by continuously incorporating input from human experts. Specifically, the team illustrated the platform could detect 85% of attacks, which was approximately three times better than previous benchmarks. It also reduced the number of false positives by a factor of five. Generally speaking, machine learning technologies can be used to provide around the clock analysis or assist junior analysts who have higher error rates in their ability to assess a threat.

Preventing zero-day exploits: Additionally, machine learning can be leveraged to combat zero-day exploits, which occur whenever a cyber criminal is able to seize upon a software vulnerability before a developer is able to release a patch for it. IoT devices are largely targeted by zero-day exploits since they often lack basic security features. Vendors are typically given a certain amount of time to patch the vulnerability before it is publicly disclosed, depending upon its severity. Machine learning could be used to narrow in on and prevent these sorts of exploits before they have a chance to take advantage of a network.

There are two major types of ML classification techniques: supervised learning and unsupervised learning which are differentiated by the data (i.e. input) that they accept. Supervised learning refers to algorithms that are provided with a set of labeled training data, with the task of learning what differentiates the labels. While in our previous example there were only two labels–„spam“ and „legitimate“ – other scenarios may contain many and many more. For example, modern image recognition algorithms such as Google Image search can accurately distinguish tens of thousands of objects and modern facial recognition algorithms exceed the performance of human beings. By learning what makes each category unique, the algorithm can then be presented with new, unlabeled data and apply a correct label.

The cybersecurity industry has struggled to keep pace with the growth of cybercrime. In 2005, there were $8.3 million reports of identity theft. By 2014, this number rose to $17.6 million. The amount of money consumers have paid to unlock computers from ransomware grew from $1 million in 2005 to $24 million in 2015. Advanced AI and machine learning applications are being utilized in cutting-edge cybersecurity services such as Managed Detection and Response MDR. These services combine the skill of human analysts, forensic investigation tools, and anomaly detection software to respond to threats in real time, 24 hours a day.