GPSBUS216-GPS Applying AI-ML to Find Security Needles in the Haystack

© 2017, Amazon Web Services, Inc. or its Affiliates. All rights reserved.
GPS: Applying AI/ML to Find Security
Needles in the Haystack
R o h i t G u p t a – G l o b a l E c o s y s t e m L e a d e r – S e c u r i t y E c o s y s t e m
P a t r i c k M c D o w e l l – P a r t n e r S o l u t i o n s A r c h i t e c t - S e c u r i t y
G P S B U S 2 1 6
N o v e m b e r 2 8 , 2 0 1 7

The opportunity

Market opportunity – the problem
7 0 % o f s e c u r i t y i n d u s t r y p r o f e s s i o n a l s b e l i e v e t h r e a t
i n t e l l i g e n c e i s o f t e n t o o v o l u m i n o u s a n d / o r c o m p l e x
t o p r o v i d e a c t i o n a b l e i n s i g h t s *
P o n e m o n S t u d y
*https://www.anomali.com/news-events/press/ponemon-report-says-70-percent-of-organizations-swamped-by-cyberthreat-data
A l e r t f a t i g u e i s a r e a l i s s u e a t c o m p a n i e s ( e s p e c i a l l y i n t h e S O C )
I N D U S T R Y P R O F E S S I O N A L S

6 2 % o f c o m p a n i e s a r e b e i n g a t t a c k e d a t l e a s t w e e k l y w i t h 2 0 %
b e i n g a t t a c k e d d a i l y a n d 1 0 % a t t a c k e d h o u r l y
*https://www.splunk.com/en_us/newsroom/press -releases/2017/security -teams-overwhelmed-by-rising-volume-of-attacks.html
I D C / S p l u n k S t u d y *
D A I L Y H O U R L YW E E K L Y

O n l y 2 7 % t h i n k t h e y a r e c o p i n g c o m f o r t a b l y w i t h t h i s w o r k l o a d
*https://www.splunk.com/en_us/newsroom/press -releases/2017/security -teams-overwhelmed-by-rising-volume-of-attacks.html
I D C / S p l u n k S t u d y *
C O M P A N I E S

Market opportunity – why AI/ML?
M A C H I N E L E A R N I N G
B y 2 0 1 8 , 2 5 % o f s e c u r i t y p r o d u c t s u s e d f o r d e t e c t i o n w i l l
h a v e s o m e f o r m o f m a c h i n e l e a r n i n g b u i l t i n t o t h e m *
G a r t n e r
* h t t p : / / w w w . g a r t n e r . c o m / s m a r t e r w i t h g a r t n e r / s e c u r i t y - e m b r a c e s - a d v a n c e d - a n a l y t i c s - a n d - m a c h i n e - l e a r n i n g /
T h e r e i s n o o t h e r w a y t o s t a y a h e a d o f t h i s !

M A C H I N E L E A R N I N G
B y 2 0 2 0 , 1 0 % o f p e n e t r a t i o n t e s t s w i l l b e c o n d u c t e d
b y m a c h i n e - l e a r n i n g - b a s e d s m a r t m a c h i n e s , u p f r o m
0 % i n 2 0 1 6 *
G a r t n e r
* h t t p : / / w w w . g a r t n e r . c o m / s m a r t e r w i t h g a r t n e r / 7 - t o p - s e c u r i t y - p r e d i c t i o n s - f o r - 2 0 1 7 /

A D V A N C E D S E C U R I T Y A N A L Y T I C S
B y 2 0 2 0 , A d v a n c e d S e c u r i t y A n a l y t i c s W i l l B e E m b e d d e d
i n a t L e a s t 7 5 % o f S e c u r i t y P r o d u c t s 3 *
G a r t n e r
* h t t p : / / w w w . g a r t n e r . c o m / s m a r t e r w i t h g a r t n e r / 7 - t o p - s e c u r i t y - p r e d i c t i o n s - f o r - 2 0 1 7 /

Market opportunity – security market
1http://www.gartner.com/newsroom/id/3784965
S e c u r i t y s e r v i c e s i s t h e
s i n g l e b i g g e s t a r e a o f s p e n d
S e c u r i t y s p e n d i n g i n 2 0 1 7 i s
$ 8 6 . 4 B a n d p r o j e c t e d t o b e
o v e r $ 1 0 0 B i n 2 0 2 0 1
G a r t n e r

It is already happening in Cybersecurity
https://www.cbinsights.com/research/cybersecurity-artificial-intelligence-startups-market-map/

How AWS helps partners

AWS AI Platform

Enterprises across industries run AI/ML on AWS

AWS offers a range of tools to make AI/ML accessible
These solutions are underpinned by proven,
scalable AWS products and services
AWS
Greengrass
AWS
IoT
AWS
Lambda
Amazon EC2
(P2 and G2 GPUs)
Amazon
S3
Amazon
DynamoDB
Amazon
Redshift
Amazon EC2
(CPUs)
Amazon EC2
(ENA)
Deep Learning FrameworksMachine Learning PlatformsAmazon AI/ML Services
PollyLex Rekognition
Amazon ML
Spark & EMR
Kinesis
Batch
ECS
Usability/simplicity:
leverages AWS AI/ML expertise
Greater control:
customer-specific models

Deep experience with AI/ML differentiates our services
Amazon has invested in AI/ML since our
inception, and we share our knowledge and
capabilities with our customers
Checkout-free
shopping
using deep learning
Natural language
processing-supported
contact centers
ML-driven supply
chain and
capacity planning
Product
recommendation
engine
Robot-enabled
fulfillment
centers
New
product
categories
20171995

Infrastructure
Frameworks
Platforms Amazon ML ECSSpark & EMR Kinesis Batch
GPU MobileCPU IoT
Services Lex (language) Polly (speech) Rekognition (vision)
Apache
MXNet
Torch
Cognitive
toolkit
KerasTheano
Caffe2
& Caffe
Tensor
Flow
AWS Deep Learning AMI
AI/ML in the hands of every developer!
Gluon

p 3 i n s t a n c e s
14x improvement
D e e p L e a r n i n g A M I
Preconfigured for Deep Learning
C F N Te m p l a t e
Launch a Deep Learning Cluster
AWS Tools for Deep Learning

Partnering with AWS

APN Partne r Op p ortu nitie s
DEVELOPMENT CO-SELLING AND GTM
Accelerate AI Development on AWS
Integration with AI Services
and Platforms
Services span from expert level
to application developer
Marketing & co-branding
Funding for PoCs and innovation
Sales and Solution Architecture
Training
SA & Segment Support and Event
attendance / speaking
MONETIZATION
Expand your global reach
Enable customers to search for
and discover your solutions
Sell preconfigured, AWS
Marketplace-ready solutions
Benefit from AWS brand recognition

• Trusted APN Partner Program
• Short list of top technically validated APN
Partners
• Connects AWS Customers with APN Partners
that have demonstrated technical expertise
and proven customer success
W H A T I S
T H E A W S
C O M P E T E N C Y
P R O G R A M ?

• D i f f e r e n t i a t e s t o p , v a l i d a t e d
p r o d u c t s , p r a c t i c e s , a n d s o l u t i o n s t o
c u s t o m e r s
• S h o w c a s e s c u s t o m e r a n d t e c h n i c a l
s u c c e s s a c r o s s A W S d i g i t a l
p r o p e r t i e s
• P a r t n e r s r e c e i v e p r e f e r r e d a c c e s s t o
A W S C o m p e t e n c y e v e n t s , A W S
s p o n s o r s h i p s , a n d r o u n d t a b l e s
• S e l e c t i v e e l i g i b i l i t y t o c u s t o m e r
o p p o r t u n i t i e s a n d a c c e s s t o M D F
f u n d i n g
• C o - m a r k e t i n g a n d a w a r e n e s s
c a m p a i g n a c t i v i t i e s
A W S
C O M P E T E N C Y
B E N E F I T S F O R
P A R T N E R S

AWS Security Competency
22
C A T E G O R I E S
Security
ISV
Infrastructure Security
Access & Control
Logging & Monitoring
Configuration & Vulnerability Analysis
Data Protection
Consulting & Services
Security Engineering
Governance, Risk & Compliance
Security Operations & Automation

APN Partne r Su p p ort
FUNDING BY LEVEL SEGMENT & PSA SUPPORT
Standard
Standard + Competency
Advanced
Advanced + Competency
Premier
Support Security
Competency Partners at
on-site events
Provide AWS resources and
speakers
Solution & Architecture
support
ADDITIONAL AR/PR
SUPPORT
AR briefings by industry
highlight Competency
Partners
Custom PR Templates
available

APN Partne r Su p p ort
CO-MARKETING PRIORITY ACCESS
Events, 3rd Party and AWS
APN and Pubic Sector Blogs: guest
posts, solution deep dives,
competency announcements,
summit and re:Invent sessions
summaries and re-caps and session
awareness on APN Blog
Partner Success Stories
Partner Videos
Webinars
AWS Sponsorships
AWS Quick Starts
Private Betas
Roadmap Briefings
AWS subject matter webinars
AWS Roadmap briefings from
AWS Service Team
ADDED VISIBILITY
Sales enablement resources
Field enablement
AWS Sales teams calls and resources

A D D E D V I S I B I L I T Y
A T 3 R D P A R T Y A N D
A W S L E D E V E N T S
Events
AWS Competency exclusive ‘Solutions
Showcase’ to customer events piloting
at the SF & NY lofts
Exclusive AWS Competency
Community Council with leadership
re:Invent expo banner and
sponsorship pages
Launch partner logos on stage

Customer & Partner
Success Stories

T re nd Micro
Training models based on 50 million
static samples and 5 million event logs
5 million endpoints using ML
2 thousand new virus detections daily
Reduced model preparation time from
2 days to 4 hours

CrowdStrike ML at Scale
Sensors
>1M events/sec peak
Falcon
Platform
Ingestion
Long-term
batch
processing
Real-time
stream
processing
ThreatGraph
Graph Database
2 PB entities and relationships (Cassandra
on EBS)
5 PB historic data in S3
10 GB/sec stream data
AWSInfrastructure
PREVENT DETECT HUNT

Ale rt Log ic
Automated breach detection identified 228 sophisticated, multi-stage attacks with
supervised ML analytics across 4,000 customers
In 64% of these previously escalated incidents ML model identified long-term pattern
not visible to human analysts
36% of these incidents were not detected by human analysts
Machine learning algorithm achieved 98% accuracy
50% of over 240,000 incidents were assisted with ML technology (clustering &
filtering) allowed escalation of priority of only 15% of these

Sp lu nk Ente rp rise Se cu rity @
Machine Learning underlies User Behavior Analytics for unknown threat
and anomaly detection
Automated threat hunting and 90% of its security metrics process in just
two months, saving 30 hrs/month
Blocked over 2M security threats with only 12 false positives over a six-
month period

Common Themes
Need high quality + lots of data
for training
Threat intelligence needs to be
applied to the process
Manual analysis needed initially
to reduce false positives/
missed alerts
Feedback loop to continually
improve the algorithm(s)
BUT
The adversary is moving
fast as well (and, possibly,
applying ML too!)
ML can also be tricked

Key Takeaways

Key Takeaways
The volume of data is growing and it is becoming untenable for
SOC analysts to keep up with (resulting in alert fatigue)
Attacks are becoming too sophisticated and voluminous to detect
manually
Machine Learning is fast becoming a widely deployed technology
across the security industry – it is the “new normal”
AWS is used by leading ISVs and customers to build AI & machine
learning solutions
APN provides resources to partners that want to start using AI/ML for
security use cases
Security Competency is a differentiator for ISV & SI APN Partners
@AWS_Partners

Resources
Promotion
POC Credits for AI/ML
workloads for security on
AWS
Reading
The Master Algorithm: How
the Quest for the Ultimate
Learning Machine Will
Remake Our World : Pedro
Domingos
CrowdStrike: “The rise
of Machine Learning in
Cybersecurity”
Cylance: “Introduction to
Artificial Intelligence for
Security Professionals”
Developer Resources:
https://aws.amazon.com/a
mazon-ai/
Deep Learning AMI |
Amazon Linux
Deep Learning AMI |
Ubuntu
AWS CloudFormation
Template instructions
ML applied to CloudTrail
events
Amazon ML Solutions
Lab
https://aws.amazon.com
/ml-solutions-lab/

THANK YOU!
P l e a s e f i l l o u t a s u r v e y o f t h i s s e s s i o n : G P S B U S 2 1 6
@AWS_Partners

GPSBUS216-GPS Applying AI-ML to Find Security Needles in the Haystack

Recommended

Recommended

More Related Content

What's hot

What's hot (20)

Similar to GPSBUS216-GPS Applying AI-ML to Find Security Needles in the Haystack

Similar to GPSBUS216-GPS Applying AI-ML to Find Security Needles in the Haystack (20)

More from Amazon Web Services

More from Amazon Web Services (20)

GPSBUS216-GPS Applying AI-ML to Find Security Needles in the Haystack