Skip to Main Content
Security with AI and Machine Learning
book

Security with AI and Machine Learning

by Laurent Gil, Allan Liska
February 2019
Intermediate to advanced content levelIntermediate to advanced
70 pages
1h 28m
English
O'Reilly Media, Inc.
Content preview from Security with AI and Machine Learning

Chapter 6. AI and ML on the Security Front: Beyond Bots

AI and ML aren’t just useful for bot detection and remediation; they are also used to improve a wide variety of security challenges. This chapter discusses some of the areas where AI and ML are making a big impact in security.

Identifying the Insider Threat

Users have established patterns of behavior within a network. They log in at a certain time, log out at a certain time, visit the same systems within the network, and generally communicate to the same places. But sometimes those patterns change. The pattern might be a one-time thing, such as someone who jumps in to help accounting toward the end of the quarter, or it might be a permanent change because of new job responsibilities. Of course, sometimes that change in behavior is because the user is accessing systems they shouldn’t for malicious purposes. This is what is known as an insider threat, and it is a real challenge for security teams to deal with.

How can your security team examine millions of lines of logs and network traffic flow data to look for patterns that indicate whether a change in behavior is malicious or part of the regular workflow? There is a framework created around this type of analysis called user and entity behavior analytics (UEBA) that tracks the behavior of users and systems within an organization. UEBA looks at traffic flows, as well as roles and responsibilities, and alerts on any behavior outside the norm.

For example, a human resources ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Start your free trial

You might also like

Machine Learning and Security

Machine Learning and Security

Clarence Chio, David Freeman

Publisher Resources

ISBN: 9781492043133