Machine learning cybersecurity boon or boondoggle

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

SESSION ID: SESSION ID:
#RSAC
Zulﬁkar Ramzan, Ph.D
Machine Learning:
Cybersecurity Boon or Boondoggle?
AIR-W03
Chief ...

#RSAC
Outline
2
High-Level Overview of Machine Learning
How Machine Learning Can be Used in a
Cybersecurity Context
PiJa...

#RSAC
What is machine learning?

#RSAC
4
Machine Learning Overview
“Field of study that
gives computers the
ability to learn
without being
explicitly
pro...

#RSAC
5
Machine Learning Process
Data
Model
PredicMons
Data
Model
Parameters: ?,?,?
PredicMons
Data
Model
Parameters: ...

#RSAC
6
What Machine Learning is Not…
In Kasparov vs. Deep
Blue, the machine’s
programmers (with help
from a team of st...

#RSAC
7
Supervised Learning
<Example 1, Label 1>
<Example 2, Label 2>
.
.
.
<Example N, Label N>
Generate
Model
Apply Mo...

#RSAC
8
Supervised Learning: More reﬁned…
<Ex. 1, Label 1>
<Ex. 2, Label 2>
.
.
.
<Ex. N, Label N>
Generate
Model
Apply...

#RSAC
9
Unsupervised Learning
Learn from unlabeled examples

No labels, so no noMon of right/wrong

Useful for idenMfyin...

#RSAC
How can machine learning be
used in a cybersecurity sejng?

#RSAC
11
Applying Supervised Machine Learning to Security
Supervised machine learning naturally suited to classiﬁcaMon (...

#RSAC
12
Unsupervised Machine Learning and Security
Unsupervised machine learning can be used to cluster data – which ca...

#RSAC
What are the piJalls and best
pracMces when applying machine
learning to cybersecurity?

#RSAC
14
Challenge: Good Data is CriQcal
Machine learning is garbage-in-garbage out
Training set ideally has to be repre...

#RSAC
15
Data
Features
Classiﬁers
PiRall: Becoming Obsessed with Classiﬁer Orderofimportance
AmountofMmespent

#RSAC
16
Challenges: Class Imbalance in Security
# Good
instances
>> # Bad
Instances
Must
sidestep
many
landmines
Securi...

#RSAC
17
Typical Metrics
Classic eﬃcacy metrics:
True PosiMve Rate (TPR): % of actual malicious
transacMons are correctl...

#RSAC
18
False PosiQves Don’t Tell the Whole Story
Suppose that you have built a system with a false posiMve rate of %0....

#RSAC
19
Think About Your Metrics Carefully
Not all false
posiMves
created equal
(popular ﬁle
vs. rare ﬁle)
Not all true...

#RSAC
20
Machine Learning PiRalls: Adversaries Adapt
Threat actors change
behaviors as needed;
Mme to change is
correla...

#RSAC
21
Supervised Learning PiRalls
Training set captures what you know about;
inferences from training set expand your...

#RSAC
22
The importance of line 23…

#RSAC
23
Unsupervised Learning PiRalls
Unsupervised learning
used to ﬁnd abnormal
behaviors, but that’s not
the same as ...

#RSAC
24
Model Deployment
Key Concerns:
Machine Learning
algorithms can produce
models, but that model
sMll has to be de...

#RSAC
25
Best PracMces:
•  Data >> Features >> Classiﬁer
•  Know what success means (not necessarily high TP, low FP)
•  ...

#RSAC
Apply What You Have Learned (1)
26
Next week, you should:
IdenMfy what cybersecurity eﬃcacy metrics maer to you
De...

#RSAC
Apply What You Have Learned (2)
27
What data sources are being fed into their machine learning system?
How is eﬃca...

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

2024 Trend Updates: What Really Wor... by Search Engine Jou... 1063109 views
Storytelling For The Web: Integrate... by Chiara Aliotta 981811 views
Artificial Intelligence, Data and C... by OECD Directorate ... 923520 views
How to Leverage AI to Boost Employe... by SocialHRCamp 392340 views
2024 State of Marketing Report – by... by Marius Sescu 221896 views
Everything You Need To Know About C... by Expeed Software 237729 views

View on Slideshare

1 of 27 Ad

View on Slideshare

1 of 27 Ad