Modernizing Cybersecurity Operations with Machine Intelligence

Chapter 1. Introduction

It’s no secret that adversaries and hackers have gained significant and distinct advantages over the good guys in modern cyber warfare. The good guys in this case include government organizations and businesses of all sizes who are constantly under a barrage of cyber-attacks from a growing set of adversaries. Their cyber defensive tools have also become less effective as attack campaigns have evolved to circumvent the current signature and behavior-based paradigm.

In 2017 alone, cyber criminals breached major credit bureaus, telecom providers, government entities, mobile applications, shipping companies, U.S. voting institutions, and countless individuals.¹ Data stolen from these groups contains personally identifiable information, financial records, and even classified intelligence; each of which attackers can use toward harmful means.

One such major breach occurred in May 2017, in which the WannaCry ransomware attacked tens of thousands of PCs, forcing 16 hospitals in the United Kingdom to close. According to The Guardian, the attack “resulted in operations being canceled, ambulances being diverted, and documents such as patient records made unavailable in England and Scotland.”² Unfortunately, the barrier to entry for cyber criminals is shrinking and the capabilities are no longer exclusive to sophisticated spy agencies. In many cases, the technologies utilized to execute these massive-scale attacks are available through open source means and exploit ...