More Machine Learning Models != Better Results

Earlier this week, Techspective published “Three Critical Machine Learning Questions for Cybersecurity Pros.” That article highlights how ML is changing cybersecurity workflows and it’ll give you some things to consider as you evaluate alternatives. Have a look and let me know what you think!

Posturing has always been a part of the cybersecurity industry. Every new technology advancement – including the current rush towards machine learning (ML) – soon deteriorates into “mine is bigger than yours” data sheet swagger (the most signatures, the most malware samples, or the longest IP reputation lists) coupled with a healthy dose of technobabble.

At RSA 2017, vendors adopting ML were true to form. I saw companies one upping each other with claims to 500 models, 1,000 models, and more. They touted their Neural Networks, their Bayesian networks, and their deep learning capabilities. Some user and entity behavior analytics (UEBA) vendor dashboards even had complicated mathematical formulas for customers to tweak. I asked just one question: “Is there one threat your models catch that no other competitor can spot?” I usually got back some explanation about how their ML math is better than the anyone else’s.

So it’s worth asking: can ML really keep up with ever-changing zero-day attacks and advanced persistent threats (APT)? Or is it just another meaningless set of metrics to tote up and technology buzzwords to hammer over your competitors’ heads?

To be clear, I’m a convert. Machine learning has tremendous promise for cyber security but, if we don’t use it differently, security will remain an asymmetric war in which adversaries can acquire the same security tools and threat intelligence as the good guys. Think about it this way: if a rogue nation wanted to build a stealth bomber, imagine if they knew everything there is to know about their adversary’s radar systems. And imagine they also had a subscription that informed them about any new radar designs. That would be one hard-to-stop bomber.

ML security vendors are falling into the same old trap. They are starting with an exploit and then building a model to catch it (and other attacks like it). Each model is designed for the exploit while being common for every customer. Much like old-school attack signatures, this approach suffers from three major problems:

• Not effective – models designed to catch known attacks make it far easier for attackers to find ways to evade detection. Day-zero attacks are still a significant vulnerability.
• Too complex – it takes 1,000 models to catch 1,000 unique attacks. More models means more complexity and confusion.
• Too much maintenance – common models have to take customer-specific differences into account, which means models aren’t effective until they’re manually tuned to the specifics of the customer. The result? The same rule and policy overhead machine learning was supposed to eliminate.

We have a different approach at Lacework. Instead of starting with thousands of exploits and building models to stop each one, we use unsupervised machine learning to build a baseline for each cloud deployment. We develop exhaustive insights, with information about all entities and their behaviors. Every baseline is as unique as the deployment it protects, making it easy to accurately spot the changes (using supervised machine learning) that always accompany an attack. A successful hacker would 1) have to have an omniscient understanding of your specific cloud deployment and 2) design an attack that perfectly mimicked normal behavior in that deployment. A tough challenge indeed.

Two more innovations make our approach even more effective. First, when baselining the behavior of your cloud solution, we focus on the process level (Vikram Kapoor, my cofounder, wrote a great blog that details how this works in his Introduction to Polygraphs blog). That closes security gaps across your cloud deployment. Second, we model entities and interactions at an abstract, functional level (not at the network or server level). This means normal changes in the cloud (like the elasticity of machines and containers that scales but doesn’t change the solution) do not result in false alarms. Because cloud applications behave more predictably than human users we can avoid heuristics or statistical analysis. That means every event we generate will be for a desired change, a misconfiguration, or a malicious activity.

Lacework turns the old security model on its head. Instead of using a large number of common models shared across many customer’s deployments, we develop one model that’s unique to each deployment. We can catch any threat – whether it has or hasn’t been seen before – because we look for the changes that are leading threat indicators. Adversaries now have a far more difficult task: instead of looking for weaknesses in shared models, they must perfectly mimic normal behavior in your environment. Now that your adversaries have no clue about your radar, that stealth bomber’s going to be much harder to build.

Full article can be read here: Three Critical Machine Learning Questions for Cybersecurity Pros