Slashdot Mirror
Harnessing Artificial Intelligence To Build an Army of Virtual Analysts
An anonymous reader writes: PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market. Their goal was to make a system capable of mimicking the knowledge and intuition of human security analysts so that attacks can be detected in real time. The platform can go through millions of events per day and can make an increasingly better evaluation of whether they are anomalous, malicious or benign.
So, when they publish their findings will someone modify it to make an army of virtual hackers?
Because that would be awesome.
Lost at C:>. Found at C.
Their goal was to make a system capable of mimicking the knowledge and intuition of human security analysts so that attacks can be detected in real time.
That boils down to letting the expensive firewalls do their job and checking the log files later on. Meanwhile, back to minesweeper.
The AI crowd has a history of talking big, and delivering little. We'll see how this turns out, but since Google Now, Siri et al., with their inveterate stupidity and lack of common sense, are hailed as the pride and joy of the AI crowd, I'll remain highly skeptical.
Every story on the last three pages was posted by you.
Please let someone else post something.
Everyone else please post something!
Here i'll start Amit Singhal, the longstanding chief of Google Search operations is leaving google after 15 years. http://www.wired.com/2016/02/a...
Minimum threshold fixed. Thanks!
More snake oil. None of this matters when dumb little suzy clicks the .exe or .pdf, everytime.
>> Their goal was to make a system capable of mimicking the knowledge and intuition of human security analysts so that attacks can be detected in real time.
Did they manage to avoid mimicking all the foolishness and gullibility of human security analysts, too?
>> The platform can go through millions of events per day and can make an increasingly better evaluation of whether they are anomalous, malicious or benign.
So, based on this, it sounds like the 'quality' of the service depends on parsing data supplied by (hostile) outside sources. If the system cannot tell when people are deliberately poisoning its knowledge base with feints and false messages, then what? Human supervision? If it needs human security analysts anyways, how much does it gain?
With the big RSA security conference on the horizon, expect to see lots of stories about the latest security solutions, especially from start ups.
If you want good security, work on implementing the SANS Top 20 security controls instead of looking for a silver bullet.
Average Intelligence is a Scary Thing
HAL, are you blocking all my ummm work related internet access
There's still a great advantage for the human security analyst. The human may not be as fast or as infallible. One may not be as infallible as the AI when things are going smoothly. However, the human will still need to make sure the AI is making sense. Someone needs to make sure the traffic being flagged is consistent with actual traffic. The AI can itself be subverted via code. The AI can have a subtle bug that makes it stop making sense in some obscure edge case that isn't covered well in testing. The human cannot be so easily fooled or subverted. It's going to be a team effort. It's just that it'll be the AI and a handful of humans doing what a much bigger team of humans used to do.
That was their secondary fall-back goal.
The primary was to be able to predict stock and commodity markets, or at least sports events. They gave it up because it wasn't really contributing to the greater good of humanity. No, really. Cross my heart.
At the bottom of the
they want their anti-virus back
Is this what finally leads to the Singularity or Skynet?
"If any question why we died, Tell them because our fathers lied."
Ya know, I love SANS, but since when do they leave off the top three of any security list, "Patch, patch, patch"
CSC 1: Inventory of Authorized and Unauthorized Devices
CSC 2: Inventory of Authorized and Unauthorized Software
CSC 3: Secure Configurations for Hardware and Software on Mobile Devices, Laptops, Workstations, and Servers
CSC 4: Continuous Vulnerability Assessment and Remediation
CSC 5: Controlled Use of Administrative Privileges
CSC 6: Maintenance, Monitoring, and Analysis of Audit Logs
CSC 7: Email and Web Browser Protections
CSC 8: Malware Defenses
CSC 9: Limitation and Control of Network Ports, Protocols, and Services
CSC 10: Data Recovery Capability
CSC 11: Secure Configurations for Network Devices such as Firewalls, Routers, and Switches
CSC 12: Boundary Defense
CSC 13: Data Protection
CSC 14: Controlled Access Based on the Need to Know
CSC 15: Wireless Access Control
CSC 16: Account Monitoring and Control
CSC 17: Security Skills Assessment and Appropriate Training to Fill Gaps
CSC 18: Application Software Security
CSC 19: Incident Response and Management
CSC 20: Penetration Tests and Red Team Exercises
This could be a wonderful technology but I'll bet the bloopers will be something else at times. It could be sort of like Baby Bush invading the wrong nation.