Machine Learning - SITA Enable Intelligent... · 2019-03-25 · • Machine learning is not a...

Paul Beyleveld, CISSP

Consulting Systems Engineer

for Cybersecurity in the Digital Era

Machine Learning

pbeyleve@cisco.com

@RegardingPaul

/paulbeyleveld

Gartner Hype Cycle for Emerging Technologies | 2017

MACHINE LEARNING

Expectations

Source: Gartner (July,2017)

Innovation Trigger Peak of Inflated Expectations Trough of Disillusionment Slope of Enlightenment Plateau of Productivity

Investment in and adoption of ML/AI is dramatically increasing.

$10B VC investment in ML/AI companies in

2017 PITCHBOOK

75% Of dev teams building AI functionality IDC

30% CIO top 5 investment priority GARTNER

Highly skilled and determined attackers + Ever-growing attack surface

Today’s Situation

Attackers Advantages Environmental Challenges

Expansive adversary tool box Explosive growth of endpoints

Exhaustive nonstop attacks Exponential growth of network traffic

High velocity Complex application environment

Defender Challenges Defender Realities

Constrained security budgets 35% report $ as #1 constraint

Overwhelming volume of alerts 56% of alerts investigated

Unrelenting velocity of alerts 46% of legitimate alerts remediated

Constrained Budget, Time, Talent & Ability to respond to threats

Highly skilled and determined attackers + Ever-growing attack surface

Today’s Situation

Attackers Advantages Environmental Challenges

Expansive adversary tool box Explosive growth of endpoints

Exhaustive nonstop attacks Exponential growth of network traffic

High velocity Complex application environment

Defender Challenges Defender Realities

Constrained security budgets 35% report $ as #1 constraint

Overwhelming volume of alerts 56% of alerts investigated

Unrelenting velocity of alerts 46% of legitimate alerts remediated

Constrained Budget, Time, Talent & Ability to respond to threats

Operationalizing Security

…a business-driven cybersecurity model—one

that can provide resiliency to increasingly flexible,

open enterprises even in the face of highly capable

and determined malevolent actors—is starting to

emerge. - McKinsey&Company

Reduce Adversary’s Operational Space

Machine Learning

The Big Picture

Artificial Intelligence

Machine Learning

Supervised Learning

Unsupervised Learning

Reinforcement Learning

Machine Learning

So what is it?

Arthur Samuel’s definition of machine learning in 1959

“Field of study that gives computers the ability to learn without being explicitly programmed.”

Traditional programming

Live Data

Program Output

Traditional programming vs. machine learning

Live Data

Program Output

Training

Program

(Model)

Output

Natural conclusion: Training data is important and we have lots and lots of it.

Identifying Encrypted Malware Traffic with Contextual Flow Data

Blake Anderson and David McGrew

300+ Full Time Threat

Intel Researchers

MILLIONS Of Telemetry

Agents

4 Global Data

Centers

1100+ Threat Traps

100+ Threat Intelligence

Partners

THREAT INTEL

1.6 MILLION Daily Malware

Samples

600 BILLION Daily Email

Messages

16 BILLION Daily Web

Requests

Honeypots

Open Source

Communities

Vulnerability

Discovery (Internal)

Product

Telemetry

Internet-Wide

Scanning

20 BILLION

Threats Blocked

INTEL SHARING

INTEL BREAKDOWN

Customer Data

Sharing

Programs

Service Provider

Coordination

Program

Source

Sharing

3rd Party Programs

(MAPP)

Industry

Sharing

Partnerships

(ISACs)

Participants

300+ Engineers working full time on AI/ML

Some of the most brilliant minds in the industry

Collab team beat Google’s own

internal model in Google’s

TensorFlow Speech Recognition

Contest

Cisco Talos Team won round one

of the Fake News Challenge

Example: CTA Detection Technology

hxxps://136.243.4.68

hxxps://64.233.162.83

Which of these encrypted request is malware c&c?

It depends

hxxps://136.243.4.68

• Malware c&c and exfiltration (encrypted)

hxxps://64.233.162.83

• Google Mail (encrypted)

Which of these encrypted request is malware…

hxxps://google.com

hxxps://llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch.co.uk

Which of these is more legit?

hxxps://google.com

• Used commonly by malware – connectivity check

hxxps://llanfairpwllgwyngyllgogerychwyrndrobwllllantysiliogogogoch.co.uk

• Welsh village with the longest name in Britain

Which of these is more legit?

Malware detection using cognitive analytics

Value of AI and ML in Cybersecurity?

• AI/ML systems analyse internal security data, and correlate it with external threat data - points human analysts to needles in the haystack.

• System adapts its monitoring and analysis based on human input, optimizes likelihood of finding real cyber threats & minimizing false positives

• Enables Behavioural Analytics to understand normal behavior by analysing data over time to identify anomalous and suspicious behaviors that deviate from normal baseline

• Enables analysts to focus on more advanced threat investigation rather than performing tactical data crunching.

Network Telemetry

Distribution/Core Switch

Access Switch Endpoint Agent Firewall

Proxy Identity AD & DNS

Global Intelligence

Isolated knowledge based on function and location

Telemetry: an automated communications process by which measurements and other data are

collected at remote or inaccessible points and transmitted to receiving equipment for monitoring. https://en.wikipedia.org/wiki/Telemetry

Network Devices

Encryption is changing the threat landscape

Percentage of the IT budget earmarked for encryption Source: Thales and Vormetric Extensive deployment of encryption

Straight-line

projection

20% 19% 22% 23% 23%

25% 27%

FY05 FY06 FY07 FY08 FY09 FY10 FY11 FY12 FY13 FY14 FY15 2016 2017

Based on Cisco threat grid analysis, 2017

Percentage of malware

Dec Jan Feb Mar Apr May

Gartner predicts that by 2019

80% of all traffic will be encrypted

What is Mobile World Congress?

More than 107,000 visitors

from 205 countries and

territories

Stealthwatch monitored all the wireless traffic to and from the Internet

with Encrypted Traffic Analytics

Over 55% of attendees

held senior-level positions,

including more than 7,700

MWC 2018: HTTPS:HTTP on the show floor

82% HTTPS vs 18% HTTP traffic mix

Detection on 2/26 and 2/27

Global Threat Analytics raised 350 events

Cryptomining

Android Trojans (Android.spy, Boqx, infected

firmware)

SALITY malware

SMB Service discovery malware

OSX Malware Genieo

Conficker

RevMob

Phishing

AdInjectors

Several Android mobile devices were identified to

have an infected firmware

Malware Trojans were identified that were using PowerShell to communicate to the C&C servers through HTTPS. Several malwares / potentially unwanted applications that used Encrypted traffic

* Over 13,500 alarms in Stealthwatch on 2/26

Over 18,500 alarms on 2/27

Initial data packet Sequence of packet

lengths and times Global Risk Map

Detect malware in encrypted traffic

Self-Signed Certificate

Data Exfiltration

C2 Message

Make the most of the

unencrypted fields

Identify the content type through the

size and timing of packets

Know who’s who of the

Internet’s dark side

Power of multi-layer machine learning

Global Risk Map Threat Grid, TALOS

Requests received

Confirmed Incidents

= 0.01% of Requests

Anomalous Traffic

Malicious Events

Threat Incidents

Increase fidelity of detection using best-in-class security analytics

Anomaly detection

Trust modeling

Event classification

Entity modeling

Relationship modeling

Summary

• Machine learning is very effective for reducing incident count to high fidelity threat incidents

• Coupled with context increases ability to detect and reduce the time to respond

• Machine learning is not a silver bullet but will help to reduce advisory operational space

• Artificial Intelligence and Machine Learning deliver intent-based networking to enable the entire network to contribute to the cybersecurity fight

Questions?

pbeyleve@cisco.com

@RegardingPaul

/paulbeyleveld

Malicious Activity and Encryption

Increase

November 2016

Attackers embrace encryption to conceal command-and-control activity

12% Increase

268% 70%

Global Encrypted Web Traffic Malicious Sandbox Binaries with Encryption

October 2017

Machine Learning - SITA Enable Intelligent... · 2019-03-25 · • Machine learning is not a...

Documents

COMP 562: Introduction to Machine Learning · Introduction to Machine Learning Machine learning: What and Why? Quiz: De ning the Learning Task "Machine Learning is the study of algorithms

Machine Learning: Machine Learning:

1. Introduction to Machine - lis-lab.fr › bernard.espinasse › ... · § 1. Introduction to Machine Learning § Machine Learning Problem § Machine Learning: Supervised & Unsupervised

Machine Learning using MapReduce - Boise State Universitycs.boisestate.edu/.../mapreduce-machine-learning-handout.pdf · 2016-10-27 · What is Machine Learning I Machine learning

Fast Track Machine Learning Part 1 (Machine Learning Overview) - Types of Machine Learning Problems

Introduction To Azure Machine Learning...Expected Learning Outcomes Azure Machine Learning @tetranoodle Supervised Machine Learning Machine Learning Algorithms in Azure ML Workflow

Machine Learning Chapter 11. 2 Machine Learning What is learning?

Machine Learning and Azure Machine Learning

Machine Learning Introduction Machine learningbejar/ia/transpas/teoria.mti/6-AP-aprendizaj… · Machine Learning Introduction Types of machine learning Inductive Learning: Models

Machine Learning for NLP - Ethics and Machine Learning

Machine Learning - SITA Enable Intelligent Ntwrk to fight... · Threat Intelligence Partners THREAT INTEL 1.6 MILLION Daily Malware Samples 600 BILLION Daily Email Messages 16 BILLION

Introducing Machine Learning · 4 ntroducing Machine Learning How Machine Learning Works Machine learning uses two types of techniques: supervised learning, which trains a model on

Machine Learning Lecture 5 Bayesian Learning G53MLE | Machine Learning | Dr Guoping Qiu1

MACHINE REASONING: A PERSPECTIVE AND …...“From machine learning to machine reasoning”. Machine Learning Volume 94 Issue 2, 2004, Pages 133-149 Machine Learning Volume …

Sita stalowe Progress · 2020-05-14 · Sita plecione Progress Sita plecione Progress stanowią podstawowy rodzaj sit stalowych. Nasz program produkcyjny obejmuje sita plecione o

Tutorial: Deep Reinforcement Learning - Machine Learning ...hunch.net/~beygel/deep_rl_tutorial.pdfTutorial: Deep Reinforcement Learning - Machine Learning

CS7267 Machine Learning introduction to machine learning

Machine Learning FabSpace March 2018 - irit.fr Learning FabSpace March 2018... · Machine Learning 5 Machine Learning • Supervised : Train / test • Predictiveanalysis Machine

Machine Learning on Spark - UC Berkeley AMP Campampcamp.berkeley.edu/.../Machine-Learning-on-Spark... · Machine Learning on Spark Shivaram Venkataraman ... Machine learning algorithms

¿Qué es Machine Learning? Usos de Machine Learning