NC1707

FEATUREREAL-TIME DETECTION
FILLING THE VOID
DAVE PALMER, DIRECTOR OF
TECHNOLOGY AT DARKTRACE
EXPLAINS THE ADVANTAGES OF
MACHINE LEARNING AND
PROBABILISTIC MATHEMATICS
FOR REAL-TIME THREAT
DETECTION
Traditionally, cyber security has rested
on two pillars. At one end of the
spectrum are the tools preventing
known attacks at network borders or on
devices, and at the other, the incident
response toolkits for handling post-crisis
events, including the clean-up. Until now
there was an obvious void, namely how best
to deal with threat actors already active and
undetected inside the network, but critically,
before they can inflict significant damage,
including theft of data.
Today's sharp rise in both the volume and
sophistication of attacks has exposed the
shortcomings of only being able to identify
previously known attack software or attack
techniques. Our businesses are not becoming
less complex, nor are digital attacks going to
become less attractive to criminals. We need
to respond with new approaches.
There has been much buzz about machine
learning and AI and the transformative
potential for cyber defence. The reality
however is that enabling computers to
perform thoughtful tasks is an incredibly
difficult objective.
To be able to detect and remediate
emerging threats, the self-learning
algorithms that power machine learning
should work on all types of networks,
including cloud, internet-connected devices
and critical infrastructure. Crucially, to detect
the most deadly and subtle threats, the
machine has to recalculate probabilities
and recalibrate its understanding of what it
considers as normal, in real time. It's one
thing to achieve that in a controlled
environment, but the true test is the ability
of the technology to continually learn and
adapt in a live and increasingly messy
enterprise network.
Learning a detailed understanding of 'self'
and being able to recognise the 'alien' is
how our biological immune systems
operate, in turn handling all of the daily
incidents of problems slipping past our
protective skin. Inspired by this, the
Enterprise Immune System is a
fundamentally different approach to cyber
security and it does not attempt to predefine
tomorrow's attacks, nor does it try to
predefine how roles or systems should
operate. Instead, the AI algorithms use a
wide variety of techniques to understand the
detailed and complex pattern of life of every
user and device in the network. From here
we can evolve a baseline of what is normal
for each element by considering all of their
complex relationships.
A further layer of probabilistic mathematics
is added to enable the machine to decide
which types of machine learning to rely on in
any given moment, and for each particular
context. Recursive Bayesian Estimation is a
novel implementation of Bayesian
mathematics which constantly revisits its
assumptions in the face of evolving evidence.
Whenever it is presented with new fact
points, the technology can change its
mind about previous decisions, much like
a human security professional. This ability
to look at long-running patterns enables
the machine to detect and take action
against subtle, early signs of in-progress
attack before any damage can be done.
For example, in the face of a
ransomware infection, this immune system
approach would recognise parts of the
behaviour of a laptop's file accesses as
abnormal and immediately isolate just
that specific threat to corporate data,
whilst leaving normal business operations
unaffected, allowing the user to continue
to work within their normal pattern of life,
using email, the internet etc. This buys the
security team time to respond on their
own terms, without being driven by
criminals.
Whereas previously threat actors could
navigate the network mostly undisturbed,
machine learning has enabled real-time
detection and remediation of in-progress
attacks. Diverse attacks against biometric
scanners, videoconferencing systems,
production data centres and major
manufacturing units have been revealed
by companies using this immune system
approach.
Incidents are inevitable in the current era,
but crises - they can be prevented. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards
JULY/AUGUST 2017 NETWORKcomputing 23