Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
AI Is Everywhere, but Don't Ignore the Basics
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Ninja
9/25/2019 | 9:30:44 PM
Re: adversarial attacks


 

It is going to be interesting to see once the market is flooded with companies, will we see improvement or will the learning process taper off after improvements to the algorithms or as it relates to tainted data. I am optimistic but only time will tell if companies like Sophos (Intercept X), Carbon-Black (with BluVector) will be able to look at datastreams and determine if that actor is just making a mistake or if it is an elaborate attack that is taking place overtime where the actor is using AI to find weaknesses.

Now that will be interesting.

T

 
howie.xu
100%
0%
howie.xu,
User Rank: Apprentice
9/25/2019 | 7:59:11 PM
adversarial attacks

Well aware of this paper.  Adversarial attacks will come to cybersecurity world more and more.  For instance, an attacker may modify a malicious activity so that its badness is preserved but can fool an ML model into thinking it's all legitimate/benign.  Zscaler being the leader in cloud security is leading the R&D in this area and we welcome top researchers and engineers out there to join our extremely interesting and rewarding journey! :)

 

-Howie Xu

 

tdsan
50%
50%
tdsan,
User Rank: Ninja
9/25/2019 | 7:08:32 PM
Re: Key points that were left out
When you get a chance, check out this article, it elaborates on the discussions we had about AI/ML.

They cover the examples you and I brought up in the discussions, it seems it just takes a small adjustment and the data is tainted, so to me that is not real AI but ML. Once AI becomes self-aware, then these problems will be a thing of the past, but there could be other things we need to address.

Todd

 
howie.xu
100%
0%
howie.xu,
User Rank: Apprentice
9/25/2019 | 7:00:37 PM
Re: Key points that were left out
Hi Todd, very true.  I didn't elaborate in this article but your point about data is very valid.  That's why my top best practice is about "not all data is created equal".  :)

Data has privacy issues, and then data quanity (volume/processing capacity) and data quality (for instance, what data can be used for what use case) issues too. The list goes on. :)

 

cheers,

 

-Howie
tdsan
100%
0%
tdsan,
User Rank: Ninja
9/25/2019 | 6:49:04 PM
Re: Key points that were left out
Yes, there is no silver-bullet, it is still a work in progress but we have to continue to move forward because the future seems to be getting brighter and brighter (or the outcomes I should say).

Of course, in the security realm, laying solutions to make it harder for the assailant to penetrate your defenses is common-sense (onion and layered approach).



And yes, I do agree, that it is going to take time for AI to make decisions that are indicative of our expected outcomes, but I am curious about the validity of data and if that data is tainted in any way (biases), the results of AI could be skewed to affect the personal lives where it has been trained (like going into neighborhoods and opening fire on people of color, possibility). I would think we need to be able to filter data that is considered way out of the normal parameters, that is up for discussion. There will be one-offs.

T

 

 
howie.xu
100%
0%
howie.xu,
User Rank: Apprentice
9/25/2019 | 3:15:23 PM
Re: Key points that were left out
Hi Todd, I appreciate your detailed feedback, compliments, comments, and questions.

 

AI/ML can help identify ""what's normal, what's abnormal" faster but then the truth is "abnormal" does not equal "malicious", as you probabaly meant to express too.

 

There is no silver bullet yet, AI/ML is help to solve a large scale problem, but one Machine Learning model often is not enough.  Often time, you need multiple models emsembled together, and you sometimes need heuristics to come to help too.

It is naive to think one machine learning model can detect anomaly and hence bad/malicious behavior, but it is reasonabe to think one machine learning model can be one of the critical pieces of the puzzle.

 

Hope it helps,

 

-howie
tdsan
100%
0%
tdsan,
User Rank: Ninja
9/12/2019 | 1:49:48 PM
Key points that were left out

1. Data: If AI/ML is a rocket, data is the fuel. AI/ML requires massive amounts of data to help it train models that can do classifications and predictions with high accuracy. Generally, the more data that goes through the AI/ML system, the better the outcome.

 I like the fact that you prefaced the statement with generally and in section 3 you addressed it quite nicely.

3. Domain experts: They play an essential role in constructing an organization's dataset, identifying what is good and what is bad and providing insights into how this determination was made. This is often the aspect that gets overlooked when it comes to AI/ML.

I do like the fact that you mentioned "what's normal, what's abnormal.". Now this statement, I am not so sure of because if we consider what is outside the various thresholds, in the human world, we have to take into consideration time or one offs. What if someone forgot to do something and they ran a task, that task was in the middle of the day but it was to go out, run a report and provide that report to the mgmt staff (that is not part of the norm from a business process standpoint but it is within the norm of normal business operations). The AI/ML could identify this task as being a threat.


However, I do like this statement you wrote, very perceptive:

2. "Wars have been won or lost primarily because of logistics," as noted by General Eisenhower. In the context of the AI/ML battleground, the logistics is the data and model pipeline. Without an automated and flexible data and model pipeline, you may win one battle here and there but will likely lose the war.


I would think it is the processes and planning that create the data (the logistics) and the pipeline is considered how the data is transferred, executed and delivered to right people at the right time, this is truly how wars are won.

"The more you sweat in peace, the less you bleed in war." - General Schwarzkopf


The details (data), planning (process) and execution (pipeline) are the key elements that are used to effectively address the issues that we see every day. The only time we are even close to winning this war on cyber-terror is when we start looking at people as human-beings and provide a roadmap to respect even the menial garbage worker, because no criminal (there are outliers) wants to remain in the same position in which they started.


Todd
sama174
100%
0%
sama174,
User Rank: Apprentice
9/11/2019 | 2:17:10 AM
Education
I really appreciate this wonderful post that you have provided for us. I assure this would be beneficial for most of the people. <a href="https://www.excelr.com/data-science-course-training-in-hyderabad/"> Data Science in Hyderabad </a>


COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM &amp;amp; Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.