The most obvious place for additional intelligence is to detect whether any network traffic patterns are benign or hostile. Consider sending files as email attachments. Do they contain viruses, Trojans, or other malware? Old-fashioned technology would examine the files for signatures—bits of code found in previous attacks or documented in other malware-infected files.

Signature databases, distributed by researchers and antivirus/malware companies, are an imperfect method for several reasons. As the number of malware variants increases, so does the number of signatures, requiring more time to process them. Furthermore, signatures are of limited use against zero-day attacks that no one has seen before.

What's needed are self-learning systems that can detect malware based on its malicious nature, regardless of whether it has a signature or has been encountered before. Self-learning systems, also known as machine learning, use AI techniques to foster pattern recognition, which is fast and efficient.

Another area where AI is impacting cybersecurity is in detecting when hackers are trying to breach passwords and permissions. Called "authentication attacks," cybercriminals scan networks for vulnerabilities, such as devices or servers without a defined password or with a known default password. AI-based systems can monitor network traffic and detect when a malicious application is scanning the network for such vulnerabilities, automatically raising an alert or initiating countermeasures. How does AI know? Because this type of network traffic doesn't fit the normal usage pattern of end users or machine-to-machine communication, and rapid pattern recognition is what many types of AI software excel at.

In these and other cases, AI does its work by applying mathematics to the problem. In fact, one could characterize all types of artificial intelligence (and there are many) as advanced mathematics. It's not about comparing files or examining signatures; the challenge is solving the mathematical problem. AI offers powerful techniques and algorithms to do exactly that.

Is it a cat? Is it a virus?

We've all seen that software on the internet is very, very smart at recognizing images. Facebook can often automatically identify our friends in photos and offer to tag them for us. Google's algorithms can identify cat videos with near-perfect accuracy. These image recognition algorithms aren't usually called AI, but they use the same machine learning and neural network techniques to perform the same task that an AI-based malware scanner might use to detect a corrupted file or an authentication attack.

The question for AI-based malware and network scanners is quite simple: Is the thing (whatever it is) safe or unsafe? These scanners are trained by "showing" neural networks or other self-learning systems numerous examples of safe and unsafe things. Once the algorithms are trained, they are ready to work in the real world and can make a very quick and efficient assessment: The file is classified as 99% likely safe and only 1% likely unsafe, so it allows it to reach the end user. The application access request is classified as 20% likely safe and 80% likely unsafe, so it blocks it.

Why isn't it a picture of a cat?

Safe. Unsafe. That's an easy call to make, but sometimes administrators or end users want a little more information. Why does AI classify an Excel spreadsheet as likely unsafe? Why does it block access to the application? Why did the JavaScript on that webpage seem, almost certainly, malicious? It's hard to get answers from machine learning systems.

Think of it like an image recognition system saying, "That image isn't of a cat." Why isn't it labeled as a cat? Well, it didn't look like one. That's the best you can learn. Perhaps that's enough for a cat photo, but in a business computer network, we need to know more: Why is that file labeled as malware? In those cases, the AI ​​system will flag the file, and then additional systems will run forensics to not only verify the initial decision but also analyze the malware to gain further insights that can be useful in detecting and thwarting future attacks.

Almost all cybersecurity companies are researching artificial intelligence to some extent; they can't afford not to. Three companies have a significant advantage with artificial intelligence and are betting on being leaders in leveraging AI to detect and prevent attacks: Cylance, Javelin Networks, and Wedge Networks.

Cylance is gold.
Cylance, based in Irvine, California, has built what it characterizes as a next-generation, AI-based antivirus. The company specializes in endpoint protection: Cylance detects (and blocks) known and unknown malware, viruses, and bots, rendering future attack methods useless.

According to Cylance, the core of its malware identification capability is a revolutionary research machine learning platform that utilizes algorithmic science and artificial intelligence. It analyzes and classifies hundreds of thousands of features per file, breaking them down to an atomic level to discern whether an object is "good" or "bad" in real time. These features are not the same as signatures: they are data points that must be examined for each file.

Stuart-McClure-wThink again about cat identification: cats have eyes, ears, noses, a head shape, and skin texture. But so do dogs, mice, and horses. It takes tens of thousands of data points to distinguish something that is almost certainly a cat from something that is almost certainly not a cat. The same is true for distinguishing a safe PDF from a malicious PDF: there is no single indicator. AI has to sift through vast amounts of data to make a confident judgment.

Stuart McClure, CEO, President, and Founder of Cylance, states: "We've cracked the code. We've discovered a way to take a very robust set of algorithms and apply them for the first time to cybersecurity. These algorithms have already been tested for over 30 years in other industries such as high-frequency trading and insurance, even genome mapping and sequencing. These algorithms take data and train the computer to recognize patterns and predict the future. It gave us a rare window of opportunity to take this new AI application and fly with it, as people were fed up with existing antivirus solutions.".

Cylance's mathematical approach stops malicious code from executing without prior knowledge or using an unknown obfuscation technique. The company says no other anti-malware product matches its accuracy, ease of management, and effectiveness, especially those that rely on traditional signature file comparison.

 

Throwing the javelin

Javelin Networks, based in Palo Alto, California, focuses on authentication attacks, where a cybercriminal has managed to penetrate a business network and is about to leverage their position to steal corporate assets. Javelin uses AI-based pattern recognition to instantly detect that a network has been compromised, typically recognizing activities performed only by attackers, such as scanning the network for vulnerabilities, easily understandable user accounts, applications, and servers.

Greg FitzgeraldWhen an attack is detected, Javelin springs into action and performs several actions simultaneously.

• An alert is raised, telling corporate security and IT professionals that the attack is happening.

• It secretly isolates the compromised endpoint (such as an end user's laptop) from access to real corporate assets, but in a way that the attacker will not detect.

• And then it creates a fictional but real network universe for the attacker, trapping them in a maze of hundreds or thousands of attractive but simulated resources.

While the cybercriminal attempts to penetrate these simulated resources further, searching for intellectual property, network passwords, and other valuables, Javelin plays with the hacker like a salmon in a fishing net. Javelin stalls the attacker while forensic tools attempt to gather information about the cybercriminals themselves.

Greg Fitzgerald, COO and CMO of Javelin, states: "Javelin is a next-generation intrusion detection technology, taking an approach that allows the attacker to reveal themselves through their actions—what they do on a compromised machine. Javelin is changing the game in how an attacker is found and stopped within an organization, essentially assuming that an attack will occur and a machine will be compromised regardless of whether it's malware or not. It saves a huge amount of resources, both financial and human, in data collection and analysis, and accelerates the time it takes to find an attacker. Current standard investigations say it takes 150 to 200 days to identify an attacker. Javelin has been able to demonstrate that it can reduce that time from months to minutes.".

Javelin Networks explains that targeted attacks rely on attackers' knowledge of the victims' internal network topology. Javelin denies them this knowledge by masking the entire topology. The moment attackers act upon the masked topology, they are caught by AI-based pattern recognition software, and their game is over.

Driving a "wedge" into the cyberattack

Wedge Networks, headquartered in Calgary, Alberta, focuses on preventing malware and cyberattacks from entering a corporate network (or a customer's home) by scanning internet and cloud traffic. The company uses numerous mathematical techniques to detect and prevent network users from contracting viruses and other malicious programs, including ransomware. Because customers are familiar with and trust signature-based security, Wedge's cloud-based security platform employs high-speed signature scanners. Wedge also uses AI technology to accelerate the malware recognition process and has partnered with Cylance to implement Cylance's AI-powered endpoint security system as part of Wedge's network-based security solution.

Wedge Advanced Malware Blocker leverages Cylance's AI technology and other technologies to detect and block viruses and advanced malware at the network level, preventing them from entering enterprise networks. By orchestrating Wedge's hyper-inspection technology with Cylance's machine learning engine and WedgeAMB threat analysis, it delivers a groundbreaking new approach to malware prevention, according to the company.

James HamiltonAs Wedge explains, threats are blocked in real time, eliminating the cost, disruption, effort, and embarrassment associated with fighting threats after they have penetrated the network. It also provides real-time visibility into the threat landscape across the entire network, enabling security personnel to identify and focus on the most critical risks first.

James Hamilton, CEO of Wedge Networks, states: "We have a new product that combines traditional cybersecurity policy, which tends to be signature-based or heuristic-based, with some of the new machine learning applications of AI. The combination of the two has proven to be very popular and very powerful. With machine learning, you can understand the motivation of malware, what it looks like, and how it acts. You don't need to know exactly what it is, but you know its attributes. If you can know what's happening at the endpoint, you can understand the malware's behavior and block it."

WedgeAMB includes WedgeIQ, an automated threat intelligence engine that collects threat data from enterprise-wide AMB systems to characterize, correlate, analyze, and visualize the threat landscape across the network. This comprehensive threat analysis tool provides threat intelligence to further mitigate evolving threats in real time.

 

Open the network bay doors, Hal

The number of threats is multiplying at an alarming rate. According to PandaLabs, more than 84 million new malware samples were collected throughout 2015—that's 230,000 new malware samples per day. That's right: a quarter of a million new malware strains detected every single day. The rate is increasing. There's no way older technologies, like signature-based analysis, can keep up. The fight against malware and cybercrime requires intelligence—artificial intelligence. Every cybersecurity company is exploring AI as an essential tool to help customers protect their networks and endpoints; Cylance, Javelin Networks, and Wedge Networks are ahead of the curve. That's good news for their customers and bad news for cybercriminals.

Watch the documentary video (English): video

Author: Alan Zeichick, NetEvents