Taking Inventory Where Do We Stand With AI and ML in Cyber Security? – Security Boulevard

Before diving into cyber security and how the industry is using AI at this point, lets define the term AI first. Artificial Intelligence (AI), as the term is used today, is the overarching concept covering machine learning (supervised, including Deep Learning, and unsupervised), as well as other algorithmic approaches that are more than just simple statistics. These other algorithms include the fields of natural language processing (NLP), natural language understanding (NLU), reinforcement learning, and knowledge representation. These are the most relevant approaches in cyber security.

Given this definition, how evolved are cyber security products when it comes to using AI and ML?

I do see more and more cyber security companies leverage ML and AI in some way. The question is to what degree. I have written before about the dangers of algorithms. Its gotten too easy for any software engineer to play a data scientist. Its as easy as downloading a library and calling the .start() function. The challenge lies in the fact that the engineer often has no idea what just happened within the algorithm and how to correctly use it. Does the algorithm work with non normally distributed data? What about normalizing the data before inputting it into the algorithm? How should the results be interpreted? I gave a talk at BlackHat where I showed what happens when we dont know what an algorithm is doing.

So, the mere fact that a company is using AI or ML in their product is not a good indicator of the product actually doing something smart. On the contrary, most companies I have looked at that claimed to use AI for some core capability are doing it wrong in some way, shape or form. To be fair, there are some companies that stick to the right principles, hire actual data scientists, apply algorithms correctly, and interpret the data correctly.

Generally, I see the correct application of AI in the supervised machine learning camp where there is a lot of labeled data available: malware detection (telling benign binaries from malware),malware classification (attributing malware to some malware family), document and Web site classification, document analysis, and natural language understanding for phishing and BEC detection.There is some early but promising work being done on graph (or social network) analytics for communication analysis. But you need a lot of data and contextual information that is not easy to get your hands on.Then, there are a couple ofcompanies that are using belief networks to model expert knowledge, forexample, for event triage or insider threat detection. But unfortunately, these companies are a dime a dozen.

That leads us into the next question: What are the top use-cases for AI in security?

I am personally excited about a couple of areas that I think are showing quite some promise to advance the cyber security efforts:

Given the above it doesnt look like we have made a lot of progress in AI for security. Why is that? Id attribute it to a few things:

Is there anything that the security buyer should be doing differently to incentivize security vendors to do better in AI?

I dont think the security buyer is to blame for anything. The buyer shouldnt have to know anything about how security products work. The products should do what they claim they do and do that well. I think thats one of the mortal sins of the security industry: building products that are too complex. As Ron Rivest said on a panel the other day: Complexity is the enemy of security.

*** This is a Security Bloggers Network syndicated blog from Artificial Intelligence and Big Data in Cyber Security | raffy.ch Blog authored by Raffael Marty. Read the original post at: http://feedproxy.google.com/~r/RaffysComputerSecurityBlog/~3/CBkWKAnpz24/

Read the original post:

Taking Inventory Where Do We Stand With AI and ML in Cyber Security? - Security Boulevard