Modernizing Cybersecurity Operations with Machine Intelligence

Chapter 4. Real-World Security Applications for Machine Intelligence

In many ways, machine intelligence can empower, advance, and transform cybersecurity. Across various cyber domains and missions, machine intelligence has established a foothold and helped enable a more analytically advanced defensive posture for organizations. In the following section, we discuss, highlight, and pull apart the practical and real-world application of machine intelligence for cyber threat hunting, malware detection, and risk scoring.

Hunting for Advanced Threats

Cyber threat hunting is the practice of reviewing security events to identify and prioritize potential threats to a network. When a network has been compromised, cyber threat hunters are frequently brought in to evaluate alerts, explore network devices, and remediate any breaches by applying changes in the network or cleaning up compromised systems. In this role, threat hunters are frequently buried by alerts or are unable to move beyond simple hunting techniques to find advanced adversaries due to the scale of data and the complexity of the threats.

Why Threat Hunting Poses a Challenge for Cyber Operations

Advanced persistent threats are making their way through network defense structures and cybersecurity tools, which look for signatures and behaviors in events. As previously stated, in many organizations, a threat actor can dwell on average 240 days before a threat hunter is able to discover and mitigate a compromise. These actors ...