NC1801

OPINION
THE DEATH OF THE SIGNATURE
THE SECURITY INDUSTRY HAS HAD ITS HEAD DOWN FOR TOO
LONG. CHAD SKIPPER, VP AT CYLANCE EXPLAINS HOW AI AND
MACHINE LEARNING ARE MAKING ANTI-MALWARE SOLUTIONS
MORE EFFECTIVE
For decades, the entire anti-malware
industry has been built on a
reactionary sacrificial lamb,
depending on the infection of patient-zero
with malware before it can be detected
and predicted. Once discovered, more
time elapses as a signature is generated
and sent to the AV provider's knowledge
base to protect other customers lucky
enough to have installed their solution -
and this is the anti-malware industry's
greatest weakness.
This model only offers a reaction to what
is already known. Due to the steady rise of
unknown threats and attackers' new
techniques, organisations have somehow
ignored the fact that preventing cyber
infections requires a lot of research,
imposing a delayed response time. In fact,
this process can take up to 12 hours for a
security team to identify a new threat and
release an identification signature. That is
an eternity. Relying on continuous updates
to protect endpoints from malware is like
installing a web browser that requires
constant patching to locate new websites.
THE ESSENCE OF TIME
The sheer volume of malware released in
the wild is drowning the legacy antimalware
industry, making a mockery of its
reactive approach. With statistics showing
that an average of 300,000 to 1 million
malware samples are created daily, it's
understandable that organisations want
new security solutions to help solve
security challenges.
Artificial intelligence and machine
learning offers hope for next-generation
anti-malware products. But can they really
help organisations stay ahead?
INTELLIGENT SOLUTIONS
With a greater demand for security, what is
needed is more than just another tool,
technology, solution, layers, or best
practice. Instead, a radical new way of
thinking is required to redefine the security
industry. That's where proactive, predictive
and preventive protection comes into play.
Artificial intelligence (AI) and its
mathematical subset, machine learning,
are radicalising the old world mode of
cybersecurity, allowing industry and
security professionals to stay ahead.
Machine learning uses algorithms to build
models that uncover patterns and
continually refine them through its
learning capability. This allows
organisations to make better decisions at
a speed and scale that surpasses human
capabilities, derived from its ability to
predict from its experience.
Every malware leaves its DNA, so by
collecting this DNA and analysing it, both
good and bad patterns can be found.
WannaCry is a great example of the
benefits of machine learning algorithms
for security. The ransomware was new and
most traditional AV solutions missed it.
However, the code that loaded was
predictably bad, so a machine learning
algorithm would have caught it
immediately. One of the marvels of
machine learning is that unlike human
analysis, once malware is deconstructed,
views of statistically similar blocks of DNA
code can be analysed to confirm the
presence of malicious code without having
to execute it first.
AI applications that use machine learning
algorithms can determine malicious files
through observation, pattern recognition
and predictive analytics. This means that
both existing and zero-day threats can be
prevented. To achieve a surpassed level of
success, machine learning algorithms can
be placed on an endpoint to conduct preexecution
static analysis and quickly
identify malicious files. Instead of relying
on cloud-based analysis techniques, the
endpoint can venture off-network and
benefit from the same level of protection
because the algorithm runs on the
endpoint. Unlike signature-based
techniques requiring network connectivity
to obtain frequent updates, machine
learning algorithms can run off-network
for months at a time and still be more
effective than fully updated signaturebased
products.
Artificial Intelligence and machine
learning technologies make a real
difference to how fast organisations can
respond to threats. Indeed, such
technologies help security teams to
identify the characteristics of unknown
threats, protect themselves, and stay at
least one step ahead. NC
34 NETWORKcomputing JANUARY/FEBRUARY 2018 @NCMagAndAwards
WWW.NETWORKCOMPUTING.CO.UK