Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

12/12/2016
11:55 AM
Rutrell Yasin
Rutrell Yasin
Slideshows
Connect Directly
Twitter
RSS
E-Mail

5 Things Security Pros Need To Know About Machine Learning

Experts share best practices for data integrity, pattern recognition and computing power to help enterprises get the most out of machine learning-based technology for cybersecurity.
5 of 6

#4 Supervised or Unsupervised Learning? It Depends

There are two camps in the machine learning space: those who adhere to supervised learning and those that rely on unsupervised learning. Choosing the one best suited for your organization will depend on your resources and environment, experts say.

With Supervised Learning, analysts help train the system. Unsupervised Learning is autonomous; it uses a set of algorithms and learns from its dataset. 

'Just as every immune system is different, every network is different, says Justin Fier, director of cyber intelligence with Darktrace, a developer of self-learning software inspired by the biological principles of the immune system, which uses unsupervised machine learning.

'Any adversary with the right amount of resources and patience can get through your perimeter. We take the approach -just as your immune systems does - of getting a sense of self,' Fier says. Once deployed on a network, the company's Enterprise Immune System constantly learns what is normal for the network. From that, analysts can pull out the most minute anomaly - the needle in the haystack of patterns that just don't belong, Fier says.  

 'We do it in an unsupervised way, meaning we are not training the device. As far as learning what the devices are, the pattern of life, the different characteristics of the data we are ingesting for the modeling - all of that is done unsupervised without any human hand at training it.' 

'I wouldn't say one [approach] is better than another,' says Fier. It comes down to resources. Once, Fier deployed the technology for a proof-of-value at a company hosting a sporting event. The network administrator was scrabbling. He said he had 'laid enough fiber cable to go to the moon and back five times,' Fier says. He didn't have the time to do a proof-of-value evaluation. 

We plugged [the Darktrace tool] in and pointed data to the device and that was it. We didn't have to spend time building up configuration files or telling it what to do. It was already built-in and learns from data,' Fier says.

Is one approach better than the other? It depends on the environment you want to deploy in. 'I would err on the side of doing unsupervised because I don't have to assign a team of people to set the things up and train it on the datasets,' he says.

Image Source: By  a-image via Shutterestock

#4 Supervised or Unsupervised Learning? It Depends

There are two camps in the machine learning space: those who adhere to supervised learning and those that rely on unsupervised learning. Choosing the one best suited for your organization will depend on your resources and environment, experts say.

With Supervised Learning, analysts help train the system. Unsupervised Learning is autonomous; it uses a set of algorithms and learns from its dataset.

Just as every immune system is different, every network is different, says Justin Fier, director of cyber intelligence with Darktrace, a developer of self-learning software inspired by the biological principles of the immune system, which uses unsupervised machine learning.

Any adversary with the right amount of resources and patience can get through your perimeter. We take the approach -just as your immune systems does - of getting a sense of self, Fier says. Once deployed on a network, the companys Enterprise Immune System constantly learns what is normal for the network. From that, analysts can pull out the most minute anomaly the needle in the haystack of patterns that just dont belong, Fier says.

We do it in an unsupervised way, meaning we are not training the device. As far as learning what the devices are, the pattern of life, the different characteristics of the data we are ingesting for the modeling - all of that is done unsupervised without any human hand at training it.

I wouldnt say one [approach] is better than another, says Fier. It comes down to resources. Once, Fier deployed the technology for a proof-of-value at a company hosting a sporting event. The network administrator was scrabbling. He said he had laid enough fiber cable to go to the moon and back five times, Fier says. He didnt have the time to do a proof-of-value evaluation.

We plugged [the Darktrace tool] in and pointed data to the device and that was it. We didnt have to spend time building up configuration files or telling it what to do. It was already built-in and learns from data, Fier says.

Is one approach better than the other? It depends on the environment you want to deploy in. I would err on the side of doing unsupervised because I dont have to assign a team of people to set the things up and train it on the datasets, he says.

Image Source: By a-image via Shutterestock

5 of 6
Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
JonKim
50%
50%
JonKim,
User Rank: Author
12/15/2016 | 3:02:27 PM
Insightful
Insightful, thank you for sharing.
gopinathmohan861
50%
50%
gopinathmohan861,
User Rank: Apprentice
12/14/2016 | 10:11:16 AM
Machine Learning - Useful points
First of all, a big thanks for the article. The informations (5 security pros) mentioned in this article very useful. As AI and ML is going to rule future world, we need to consider these security pros.
Preventing PTSD and Burnout for Cybersecurity Professionals
Craig Hinkley, CEO, WhiteHat Security,  9/16/2019
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-16531
PUBLISHED: 2019-09-20
LayerBB before 1.1.4 has multiple CSRF issues, as demonstrated by changing the System Settings via admin/general.php.
CVE-2019-9717
PUBLISHED: 2019-09-19
In Libav 12.3, a denial of service in the subtitle decoder allows attackers to hog the CPU via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c has a complex format argument to sscanf.
CVE-2019-9719
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-9720
PUBLISHED: 2019-09-19
A stack-based buffer overflow in the subtitle decoder in Libav 12.3 allows attackers to corrupt the stack via a crafted video file in Matroska format, because srt_to_ass in libavcodec/srtdec.c misuses snprintf.
CVE-2019-16525
PUBLISHED: 2019-09-19
An XSS issue was discovered in the checklist plugin before 1.1.9 for WordPress. The fill parameter is not correctly filtered in the checklist-icon.php file, and it is possible to inject JavaScript code.