The AI system that can detect 85% of cyber attacks, with a little human help

MIT scientists have built a hybrid human/artificial intelligence (AI) machine that they claim can learn how to detect 85% of cyber attacks – that’s roughly three times better than previous benchmarks – while reducing false positive rates by a factor of 5.

Nitesh Chawla, professor of computer science at Notre Dame University, said in a statement from MIT that the machine “has the potential to become a line of defense against attacks such as fraud, service abuse and account takeover.”

Researchers from MIT’s Computer Science and Artificial Intelligence Laboratory (CSAIL) and the machine-learning startup PatternEx demonstrated the platform, called AI2, in a paper titled “AI2: Training a big data machine to defend“.

As the researchers describe the current state of the art, today’s security systems are typically driven by either humans – so-called “analyst-driven solutions” – or by machine.

The problem with security systems based on fixed rules is that they miss attacks that don’t match those rules. Machine-learning approaches, as the name suggests, rely on an adaptive process that can trigger annoying numbers of false positives. (Generally speaking, consistent and repeatable results aren’t adaptive; adaptive results aren’t consistent and repeatable.)

Those false positives not only undermine trust in the system, but also defeat its purpose because the errors need investigating by humans anyway.

MIT says that its secret sauce was to merge machine AI with continuous input from human experts, or what they call analyst intuition – hence the name, AI squared.

The researchers tested the system on 3.6 billion pieces of data, known as “log lines,” that millions of people created over a period of three months.

In order to predict attacks, AI2 scans sets of data and clusters it into meaningful patterns to sniff out suspicious activity. That phase goes on with pure machine learning, without stealing precious time from expensive human analysts.

Then it presents what it’s found to those human analysts, who confirm which activity’s worth worrying about and which is safe to ignore.

That human feedback then gets pulled into AI2’s models for the next go-round of data analysis, learning as it goes so that it can refine detection rates.

CSAIL research scientist Kalyan Veeramachaneni said that this dual mode of attack makes for a machine that learns fast:

You can think about the system as a virtual analyst.

It continuously generates new models that it can refine in as little as a few hours, meaning it can improve its detection rates significantly and rapidly.

Part of the challenge of merging human- and computer-based threat detection has been the manual labeling of data for algorithms.

After all, it’s one thing for somebody on a crowdsourcing site like Amazon Mechanical Turk to label a photo subject as “objects” or “non-objects.” You need a different skill set to apply labels like “DDoS” (for distributed denial of service) or “exfiltration attacks,” Veeramachaneni said:

You need security experts.

But those security experts are busy people. And you certainly don’t want to pester them with reams of flagged data: a burden that’s caused companies to throw in the towel on some systems, the researchers said.

So a system has to get better on its own, without a burdensome amount of care and feeding.

The researchers said that AI2’s “secret weapon” is the fusion of three different unsupervised-learning methods. It culls the top events from that trio to present to analysts for labeling.

Then, AI2 builds a supervised model that it can constantly refine through what the team calls a “continuous active learning system.”

MIT outlined day one of AI2’s training: first, it picks the 200 most abnormal events and presents them to the security expert. Over time, it identifies more and more of the events as actual attacks.

The researchers said that within a matter of days, AI2 may have whittled the list down to some 30 or 40 events a day.

Ultimately, it should drive down the number of both false positives and negatives, Chawla said.

AI2 can reportedly scale to billions of log lines per day, classifying them minute-by-minute as “features” that are ultimately deemed “normal” or “abnormal.”

The more you feed it, the better it does, Veeramachaneni said:

The more attacks the system detects, the more analyst feedback it receives, which, in turn, improves the accuracy of future predictions.

That human-machine interaction creates a beautiful, cascading effect.

Image of MIT courtesy of MikeDotta / Shutterstock.com