Cyber Defense eMagazine January 2020 Edition

72
ways that are difficult if not impossible to simulate. Authentication happens inadvertently, as users simply
act like—and are—themselves.
Generalizing Behavioral Biometrics to Anomaly Detection
At Plurilock we’ve long considered behavioral biometrics to be our core competency, yet recently we’ve
been increasingly engaged in research and development on machine-to-machine security models for the
Internet of Things and in new ways to detect and stop malware.
It’s rapidly becoming clear that all of these are cases in which stronger, more efficient, and more costeffective
security can be achieved using a group of very similar anomaly detection technologies.
The claim that "identity is the new perimeter" has been making the rounds over the last year or two, and
we don't disagree with it for human users. But this claim is actually a specialized instance of a more
general claim that will shape cybersecurity in the decades to come. After all, identity is exactly the
problem—and more and more, anomaly detection methods are the best way to establish it. So it’s not
identity that is the new perimeter—it's anomaly.
Securing User Accounts, Things, and Environments
But how does anomaly detection address the other problems I just mentioned?
Recall that behavioral biometrics enables us to recognize real users. It does this not with lists of static
facts like credentials or fingerprints—that are in fact themselves vulnerabilities—but through the ability to
recognize, without biographical data or physical markers, whether someone is “being themselves” or not.
It’s fundamentally about detecting user anomalies.
Because users are human beings, we’ve long called this a biometric technology. But the same
approach—using machine learning for anomaly detection—is now proving to be effective in other areas
of cybersecurity as well. Devices are more and more like individuals in our era of highly complex things—
individual in timings, characteristics, and tendencies. This is especially true as machine learning and
automation—and the unique ways in which these affect memory, process, and latency characteristics—
take hold across more and more devices.
In the realm of malware, too, the Spy vs. Spy game of signature library updates versus new threat
"strains" in the wild will soon be supplantable by anomaly detection through machine learning. Computing
environments, process tables, and schedulers are now deep and nuanced enough to offer—once again—
rich signal environments that enable the recognition of both normal and anomalous states. The result is
software security without signature scanning.
Rather than relying on static policies—which credentials grant access, which don’t, which MAC
addresses and keys are in, which are out, which code fragments are allowed, and which aren’t—it's time
for the cybersecurity industry to begin to think in terms of recognition and anomaly detection, just as
behavioral-biometric solutions now do with human users.
72