{"id":1017,"date":"2016-07-25T15:19:39","date_gmt":"2016-07-25T13:19:39","guid":{"rendered":"https:\/\/blog.mi.hdm-stuttgart.de\/?p=1017"},"modified":"2023-08-06T21:54:43","modified_gmt":"2023-08-06T19:54:43","slug":"machine-learning-in-secure-systems","status":"publish","type":"post","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/07\/25\/machine-learning-in-secure-systems\/","title":{"rendered":"Machine Learning in secure systems"},"content":{"rendered":"

Sadly today’s security systems often be hacked and sensitive informations get stolen. To protect a company against cyber-attacks security experts define a “rule set” to detect and prevent any attack. This \u201canalyst-driven solutions\u201d are build up from human experts with their domain knowledge. This knowledge is based on experiences and build for attacks of the past. But if any attack don’t match the rules, the secure system don’t recognizes it and the security is broken.<\/p>\n

The question is: Is there a possibility to train a model based on past attacks to predict further attacks?<\/p>\n

<\/p>\n

For a company it’s really hard to define a rule set to protect all kind of attacks. Also the world is changing every day and the attacks are evolving too. In addition the environment of a company get more scaled and distributed because of mobile networks, clouds and Internet of Things (IoT).<\/p>\n

This blog post demonstrates a potential way to create a security system based on machine learning in theory. Finally this post present a real world solution by a group of researchers from MIT\u2019s Computer Science and Artificial Intelligence Laboratory<\/a> (CSAIL) and the startup PatternEx<\/a>. This solution allows to detect attacks in real-time merged with the knowledge of security experts.<\/p>\n

Big picture: Machine learning
\n<\/span><\/h2>\n
\n

\u201cWell-posed Learning Problem: A computer is said to learn from experience E with respect to some task T and some performance measure P, if its\u201d<\/p>\n

T. Mitchell , 1997<\/em><\/p>\n<\/blockquote>\n

Machine learning is a science field of Artificial Intelligence (AI) and Pattern Matching. That gives a computer the ability to learn without being explicitly programmed (A. Samuel, 1959). A machine learning algorithm gets a specific task. In our case this algorithm need to detect attacks based on the collected data from an existing security system. The machine learning model is searching for attack patterns and gains experience over time. After many iterations of learning the model creates an output for each event in the dataset and validates one by one with some performance measures like the accuracy.<\/p>\n

To learn more about machine learning click here<\/a>.<\/p>\n

The Machine learning flow for secure systems
\n<\/span><\/h2>\n

In current big networks a lot of monitoring takes place. A company use many resources to collect and store all logs in their internal databases. There are tons of collected events every day. These events need to be analyzed and the secure system need to detect attacks. This collected big data can be used as an input for a machine learning model to learn attack patterns.<\/p>\n

<\/a><\/p>\n

Overview of the machine learning workflow;<\/p>\n

There are five steps to set up a machine learning pipeline for a security task. First of all the researchers need to collect all available data for the later model. This data are assembled from server syslogs, network traffic, end-points data, external DBs and many more. The more data the better the result.<\/p>\n

Based on this data Feature Extraction takes place. These features allow pattern matching on all data sets to detect an cyber-attack by using a machine learning algorithm. Some features could be the IP-address, the port number, the transmitted data, the timestamp or the device type.<\/p>\n

The third step in the machine learning flow is the training of the model. A machine learning model fall into one of two categories: Supervised learning with labeled data. All events in the input need the label “attack” or “no attack”. The label is used while the training compares the predicted- with the real-label. The other category is unsupervised learning without any label. The algorithm compares events with each other and search for abnormal patterns in the incoming datasets.<\/p>\n

After the training an output is generated. The result is transparent and allows investigation and explanations, such as the triggered source of the attack or the most important features of the attack pattern.<\/p>\n

To improve the accuracy of the model the system gets tuned based on customers feedback which all previous steps can be adjusted and modified. In the end the pipeline are customized for a security systems task mounted on the individually<\/span><\/span> customer network.<\/p>\n

Challenging aspects
\n<\/span><\/h2>\n

To set up a machine learning pipeline for a security task is very difficult. There are a lot of challenging aspects to take care of:<\/p>\n

    \n
  • Anomaly Detection:<\/strong> A real world application only has access to unlabeled data, therefore<\/span><\/span> the model must learn abnormal pattern and outlier events. This fact leads to an unsupervised learning algorithm.<\/li>\n
  • High cost of errors:<\/strong> On the one hand the model need to find all cyber-attacks and on the other hand a model which trigger too much false positives ( = normal event detect as an attack) is not used in practice.<\/li>\n
  • Data is not public:<\/strong> Training an algorithm for secure systems is very difficult because external persons don’t get access to the necessary data. So the researchers must be physically present in the company.<\/span><\/span><\/li>\n
  • Semantic gap:<\/strong> The detection of an attack is not enough, we also need to know the source, the damage, the period of time ect..<\/li>\n
  • Evaluation difficulties:<\/strong> For an two-class classification problem a machine learning model need half data from each class. The problem is that the data normally includes very few attacks. So the model must learn a compression-pattern with very low reconstruct errors for normal events. If an event has a big reconstruction error the model detect a potential attack.<\/li>\n
  • Adversarial environment:<\/strong> The attacks and the network chang or evolve every day and the algorithm need to take care of this in real-time. So the machine learning pipeline must compare events over different periods of time.<\/li>\n
  • Real time:<\/strong> An attack must detect in real-time in a distributed and very large system. That means<\/span><\/span> the whole pipeline must be updated in a short amount of time without any break.<\/li>\n<\/ul>\n

    The best way to solve this problems is to combine the knowledge from security experts and machine learning experts. This experts need to understand the data at all and share the knowledge to build up a clear environment for the algorithm.<\/p>\n

    AI\u00b2: Training a big data machine to defend
    \n<\/span><\/h2>\n

    Researchers from MIT have developed a machine learning algorithm for secure systems in April 18, 2016. It demonstrates how an artificial intelligent platform called AI\u00b2 predict cyber-attacks in a real world network. The goal from AI\u00b2 is to defend a network of an organization and predict attacks in a minute-to-minute period of time.<\/p>\n

    The results from this system are quite amazing. The algorithm detect 85% of all attacks, which is three times better than previous benchmarks. The system also found some not known hidden attacks in the data. Another important result is that the false positives are reduced by the factor of 5. The used data are merges from 3.6 billion log lines which were generated by millions of users in about three months. The most important aspect is that the system combine the powerful pattern matching of machine learning and the domain knowledge of intern security experts.<\/p>\n

    In the first step of AI\u00b2 an unsupervised learning algorithm searches for abnormal pattern based on defined features of the stored events. Every detected anomaly could be a potential cyber-attack. After that these anomalies are presented to human analysts in a ranking system. The analysts decide which of this anomalies\/events are cyber-attacks and which are normal events in the network. This generated feedback is used as an input for another second machine learning algorithm (supervised learning). This second algorithm learns the pattern of the detected attack. Now the output of both algorithms are merged afterwards in the ranking system. Because of this combination the system learns the pattern of an attack based on the knowledge of security experts. The labeling is tricky because of the manually labeling for events by human analysts. The quality of a label depends on the knowledge from the experts. So you need very skilled security experts.<\/p>\n