{"id":27950,"date":"2019-02-18T15:51:22","date_gmt":"2019-02-18T15:51:22","guid":{"rendered":"http:\/\/www.intelligentcio.com\/eu\/?p=27950"},"modified":"2019-02-18T15:52:53","modified_gmt":"2019-02-18T15:52:53","slug":"understanding-the-role-of-ai-ml-and-deep-learning-in-cybersecurity","status":"publish","type":"post","link":"https:\/\/www.intelligentcio.com\/eu\/2019\/02\/18\/understanding-the-role-of-ai-ml-and-deep-learning-in-cybersecurity\/","title":{"rendered":"Understanding the role of AI, ML and Deep Learning in cybersecurity"},"content":{"rendered":"

Derek Lin, Chief Data Scientist at Exabeam, talks to us about AI, ML and Deep Learning and how to avoid getting lost in the hype. <\/em> <\/p>\n

When it comes to Artificial Intelligence (AI) and Machine Learning (ML), there\u2019s no shortage of buzz and hype. Often referred to interchangeably, Artificial Intelligence and Machine Learning are part of our daily reality and technology lexicon \u2013 whether it\u2019s in a product marketing pitch or a Netflix recommendation for which film to see.<\/p>\n

In cybersecurity, as these and other emerging technologies like Deep Learning (DL) evolve, their capabilities have become a driving force shaping modern cybersecurity solutions. At the same time, security practitioners, fatigued by the barrage of AI and ML messaging, are raising suspicions about vendor claims.<\/p>\n

At the InteropITX conference in 2018, panellists echoed the same sentiment about the hype, asking what can be legitimately claimed as Artificial Intelligence. The audience was encouraged to look beyond the marketing spin and find out what\u2019s really being offered.<\/p>\n

I\u2019m glad to see the hype cycle has reached its peak. It\u2019s a healthy sign that security practitioners are asking the right questions and demanding to know what constitutes reality.<\/p>\n

In order to ask the right questions, let\u2019s start with a correct understanding of the terminology. Despite all the marketing messaging, for many of us it isn’t always clear what some terms may mean.<\/p>\n

Artificial Intelligence<\/strong><\/p>\n

AI is often misunderstood and not everyone agrees on its meaning. The term Artificial Intelligence first appeared in the 1950s to describe systems comprising a set of human-defined, if\/then decision rules \u2013 which have always been easily broken and hard to maintain.<\/p>\n

For example, static correlation rules that raise alerts \u2013 used in traditional security information and event management (SIEM) \u2013 cannot learn and adapt. This results in a high number of false positives. Such AI systems appear to be intelligent in their decision-making because they make decisions. But in reality, they\u2019re 100% predetermined (based on static rules) and are drafted by humans.<\/p>\n

But the word ‘intelligence’ has stuck with the public since AI\u2019s introduction. Why not? It sounds cool. Yet today AI is often little more than a catchy marketing label, liberally applied to any system that performs tasks having some semblance of automated decision-making.<\/p>\n

Machine Learning<\/strong><\/p>\n

Machine learning is often expressed in the same breath as AI, but Machine Learning is more specific. To learn from collected data, it uses algorithms for prediction, classification and insight generation.<\/p>\n

With Machine Learning, a formal body of methods are grounded in solid mathematical foundations. Applied to cybersecurity, the right problems must be matched with the right Machine Learning tools.<\/p>\n

But not all problems require advanced Machine Learning tools. For example, some popular indicators used in user behaviour analytics (UBA) are based on simple statistical analysis, such as p-value hypothesis testing used for rare event detection.<\/p>\n

On the other hand, many cybersecurity problems cannot be solved without Machine Learning. Consider phishing scam domain detection. In this instance, the URLs, WHOIS data, other properties, as well as the known (legitimate or malicious) labels of URLs are examined in a supervised learning setting to predict whether a domain is malicious. It does so without resorting to conventional, but less effective, blacklist-based matching.<\/p>\n

Deep Learning<\/strong><\/p>\n

This is all the rage today. As with AI, Deep Learning evokes an air of sophistication, but it\u2019s also subject to misunderstandings. As a tool within Machine Learning, Deep Learning is highly dependent on matching the right problems to the right tools.<\/p>\n

Deep Learning applications are best suited in the image processing and natural language processing fields. In cybersecurity, it has found a home in packet stream and malware binary analysis. These benefit most from supervised learning, when labelled (i.e. legitimate vs. malicious) data is available.<\/p>\n

But for insider threat detection, Deep Learning doesn\u2019t enjoy wide adoption for several technical reasons. One is the black box nature of the model, where it\u2019s impossible to explain the causes of the alerts. This renders investigations difficult.<\/p>\n

Peer behind the messaging and examine what\u2019s under the hood<\/strong><\/p>\n

The cybersecurity marketplace is buzzing with AI and ML terminology. This isn\u2019t surprising as data-driven approaches do lead to exciting applications that were never possible before. That said, it\u2019s all too easy to get confused and thus, lost in the hype.<\/p>\n

It’s important to question how the problems or use cases being framed are and which analytical approaches are being used and why. Transparency and a thorough understanding of the terms and their use cases will help you demystify the hype.<\/p>\n","protected":false},"excerpt":{"rendered":"

Derek Lin, Chief Data Scientist at Exabeam, talks to us about AI, ML and Deep Learning and how to avoid getting lost in the hype. When it comes to Artificial Intelligence (AI) and Machine Learning (ML), there\u2019s no shortage of buzz and hype. Often referred to interchangeably, Artificial Intelligence and Machine Learning are part of […]<\/p>\n","protected":false},"author":21,"featured_media":27955,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[57,1489,29,93],"tags":[158,577,564,7694,3881,8450],"class_list":["post-27950","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-security","category-insights","category-software","category-top-stories","tag-ai","tag-artificial-intelligence","tag-cybersecurity","tag-deep-learning","tag-machine-learning","tag-ml"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/27950","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=27950"}],"version-history":[{"count":2,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/27950\/revisions"}],"predecessor-version":[{"id":27957,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/27950\/revisions\/27957"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/27955"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=27950"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=27950"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=27950"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}