{"id":1397,"date":"2021-03-01T01:21:58","date_gmt":"2021-03-01T01:21:58","guid":{"rendered":"http:\/\/people.utm.my\/azhari\/?p=1397"},"modified":"2021-03-01T01:22:10","modified_gmt":"2021-03-01T01:22:10","slug":"comparing-different-ai-approaches-to-email-security","status":"publish","type":"post","link":"https:\/\/people.utm.my\/azhari\/2021\/03\/01\/comparing-different-ai-approaches-to-email-security\/","title":{"rendered":"Comparing different AI approaches to email security"},"content":{"rendered":"\n

Training a machine on \u2018bad\u2019 emails<\/h3>\n\n\n\n

The first AI approach we often see in the wild involves harnessing an extremely large data set with thousands or millions of emails. Once these emails have come through, an AI is trained to look for common patterns in malicious emails. The system then updates its models, rules set, and blacklists based on that data.<\/p>\n\n\n\n

This method may be an improvement to traditional rules and signatures, but really it is only automating that flawed, traditional approach \u2013 instead of having a human update the rules and signatures, a machine is updating them instead. This is inherently reactive, and will not stop new kinds of attacks.<\/p>\n\n\n\n

The industry is beginning to acknowledge the challenges with this approach, and huge amounts of resources are being thrown into minimising its limitations. This includes leveraging a technique called \u201cdata augmentation\u201d, which involves taking a malicious email that slipped through and generating many \u201ctraining samples\u201d using open-source text augmentation libraries to create \u201csimilar\u201d emails \u2013 so that the machine learns not only the missed phish as \u2018bad\u2019, but several others like it \u2013 enabling it to detect future attacks that use similar wording.<\/p>\n\n\n\n

But spending all this time and effort trying to fix an unsolvable problem is futile. Why try and fix a flawed system rather than change the game altogether?<\/p>\n\n\n\n

The rise of \u2018fearware\u2019<\/h3>\n\n\n\n

An attack trend which spells out the limitations of the above approach is fearware. When the global pandemic hit, and governments began enforcing travel bans and imposing stringent restrictions, there was undoubtedly a collective sense of fear and uncertainty.<\/p>\n\n\n\n

Cyber criminals were quick to capitalise on this, taking advantage of people\u2019s desire for information to send out topical emails related to Covid-19<\/a> containing malware or credential-grabbing links. Attackers purchased over 130,000 new email domains related to Covid-19 to launch these attacks with relative ease.<\/p>\n\n\n\n

These emails often spoofed the Centers for Disease Control and Prevention (CDC<\/a>), or later on, as the economic impact of the pandemic began to take hold, the Small Business Administration (SBA<\/a>). As the global situation shifted, so did attackers\u2019 tactics.<\/p>\n\n\n\n

When we consider the AI approach detailed above, the question becomes: how can you train a model to look out for emails containing \u2018Covid-19\u2019, when the term hasn\u2019t even been invented yet?<\/p>\n\n\n\n

Covid-19 is the most salient example of this, but the same reasoning follows for every single novel and unexpected news cycle that attackers are leveraging in their phishing emails to evade defences and attracting the recipient\u2019s attention. Moreover, if an email attack is truly targeted to your organisation, it might contain bespoke and tailored news referring to a very specific thing that supervised machine learning systems could never be trained on.<\/p>\n\n\n\n

\"\"Use cases for AI and ML in cyber security<\/h4>\n\n\n\n

We explore how artificial intelligence (AI) and machine learning (ML) can be incorporated into cyber security. Read here<\/a><\/p>\n\n\n\n

Spotting intention<\/h3>\n\n\n\n

An important approach for future-proofing<\/a> is to analyse grammar and tone in an email in order to identify intention: asking questions like \u2018does this look like an attempt at inducement? Is the sender trying to solicit some sensitive information? Is this extortion?\u2019 By training a system on an extremely large data set collected over a period of time, you can start to understand what, for instance, inducement looks like. This then enables you to easily spot future scenarios of inducement based on a common set of characteristics.<\/p>\n\n\n\n

Training a system in this way works because, unlike news cycles and the topics of phishing emails, fundamental patterns in tone and language don\u2019t change over time. An attempt at solicitation is always an attempt at solicitation, and will always bear common characteristics.<\/p>\n\n\n\n

For this reason, this approach only plays one small part of a very large engine. It gives an additional indication about the nature of the threat, but is not in itself used to determine anomalous emails.<\/p>\n\n\n\n

Detecting the unknown unknowns<\/h3>\n\n\n\n

The secret weapon of email security is unsupervised machine learning, which starts with extracting and extrapolating thousands of data points from every email. Some of these are taken directly from the email itself, while others are only ascertainable by the above intention-type analysis. Additional insights are also gained from observing emails in the wider context of all available data across email, network and the cloud environment of the organisation.<\/p>\n\n\n\n

Only after having a now-significantly larger and more comprehensive set of indicators, with a more complete description of that email, can the data be fed into an impartial machine learning engine to start questioning the data in millions of ways in order to understand if it belongs.<\/p>\n\n\n\n

The technology identifies patterns across an entire organisation and gains a continuously evolving sense of \u2018self\u2019 as the company grows and changes. It is this innate understanding of what is and isn\u2019t \u2018normal\u2019 that allows AI to spot the truly \u2018unknown unknowns\u2019 instead of just \u2018new variations of known downfalls.\u2019<\/p>\n\n\n\n

This type of analysis brings an additional advantage in that it is language and topic agnostic: because it focuses on anomaly detection rather than finding specific patterns that indicate threat, it is effective regardless of whether an organisation typically communicates in English, Spanish, Japanese, or any other language.<\/p>\n\n\n\n

By layering both of these approaches, you can understand the intention behind an email and understand whether that email belongs given the context of normal communication. And all of this is done without ever making an assumption or having the expectation that you\u2019ve seen this threat before.<\/p>\n\n\n\n

\"\"Key cyber security trends to look out for in 2021<\/h4>\n\n\n\n

Greg Day, vice-president and chief security officer, EMEA at Palo Alto Networks, discusses the key cyber security trends that are set to emerge in 2021. Read here<\/a><\/p>\n\n\n\n

Years in the making<\/h3>\n\n\n\n

It\u2019s well established now that the legacy approach to email security has failed \u2013 and this makes it easy to see why existing recommendation engines are being applied to the cyber security space. On first glance, these solutions may be appealing to a security team, but highly targeted, truly unique spear phishing emails easily skirt these systems. They can\u2019t be relied on to stop email threats on the first encounter, as they have a dependency on known attacks with previously seen topics, domains, and payloads.<\/p>\n\n\n\n

An effective, layered AI approach takes years of research and development. There is no single mathematical model to solve the problem of determining malicious emails from benign communication. A layered approach accepts that competing mathematical models each have their own strengths and weaknesses. It autonomously determines the relative weight these models should have and weighs them against one another to produce an overall \u2018anomaly score\u2019 given as a percentage, indicating exactly how unusual a particular email is in comparison to the organisation\u2019s wider email traffic flow.<\/p>\n\n\n\n

It is time for email security to well and truly drop the assumption that you can look at threats of the past to predict tomorrow\u2019s attacks. An effective AI cyber security system can identify abnormalities with no reliance on historical attacks, enabling it to catch truly unique novel emails on the first encounter \u2013 before they land in the inbox.\"\"<\/p>\n\n\n\n

Written by Dan Fein<\/a>, director of email security products at Darktrace<\/strong><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

Training a machine on \u2018bad\u2019 emails The first AI approach we often see in the wild involves harnessing an extremely large data set with thousands or millions of emails. Once these emails have come through, an AI is trained to look for common patterns in malicious emails. The system then updates its models, rules set, […]<\/p>\n","protected":false},"author":14428,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"off","_et_pb_old_content":"","_et_gb_content_width":"","footnotes":""},"categories":[3],"tags":[],"class_list":["post-1397","post","type-post","status-publish","format-standard","hentry","category-news"],"_links":{"self":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1397","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/users\/14428"}],"replies":[{"embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/comments?post=1397"}],"version-history":[{"count":1,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1397\/revisions"}],"predecessor-version":[{"id":1398,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/posts\/1397\/revisions\/1398"}],"wp:attachment":[{"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/media?parent=1397"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/categories?post=1397"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/people.utm.my\/azhari\/wp-json\/wp\/v2\/tags?post=1397"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}