WHITE PAPER

How AI and Machine Learning
Improve Enterprise Cybersecurity
Connecting all of the Dots in a Complex Threat LandscapeA recent study1 by Information Risk
Management points out that 86 percent ofenterprises will be impacted by AI (ArtificialIntelligence) in the next five years. One of those
impacts will be in cybersecurity defenses. As
the volume of cyberattacks grows, security
analysts have become overwhelmed. With
more security- related data collected and more
tools in the market, more alerts are generated
every day, causing what is known as the “alertfatigue” problem.
On the other hand, the industry lacks enoughtrained security analysts to process such alerts.
AI and its component, Machine Learning (ML)can help automate laborious tasks like threat
hunting, threat evaluation, and threat response,
thereby relieving the burden on analysts who areawash in alerts.
AI uses algorithms to make decisions about what
to do in given situations. The algorithms are aplan for what the computer should do given
certain specific inputs, and the inputs comefrom data collected in the environment in which
the AI system works. It tries to mimic humancognitive functions, where a computer is given
the environment and the problem setting, andinstructed to find a solution to the problem. ML
uses data and prior algorithm responses to learn
what to do in similar situations in the future. In
autonomous cars, for example, the algorithms
get trained by the information regarding the car’s
surroundings and what maneuvering decisions
are corrected, and then the algorithms know
how to handle future situations that mirror thosedealt with previously.
Cybersecurity is a fertile field for applying AIand ML because there is a lot of data about
the security environment, and many attacks
are similar. With ML, the algorithms can learn
how to respond to similar attacks, achieving theautomation with AI. ML is thus a fundamental
concept that drives AI.
Researchers have tried to implement AI andML in cybersecurity solutions since the late1980s, but progress has been slow. Today, AI

and ML are showing increasing promise withthe advent of Big Data because the quality ofinformation that informs AI or from which ML
can learn is improving. However, there is much
more to be done.

Anomaly Detection – The Early Days
When we talk about security, we want a systemthat can separate good from bad, normal fromabnormal. Therefore, it is quite natural to apply
anomaly detection to security. We can trace thebeginning of anomaly detection back to 19872,
when researchers started building intrusion
detection systems (IDS). Around 1998-1999,
DARPA (the government agency that createdthe Internet), created benchmark sets andcalled for research on ML methods in security3.
Unfortunately, few of the results were practicalenough and even fewer products got to theoperational stage.
Anomaly detection is based on unsupervised
learning, which is a type of self-organizedlearning that helps find previously unknown
patterns in a data set without the use of preexisting labels. In essence, a system based on
unsupervised learning knows what is normal andidentifies anything abnormal as an anomaly. For
example, an IDS might know what ‘normal’ traffic
looks like, and it will alert on any traffic variants
that don’t match that learned knowledge, suchas with a vulnerability scanner. Usually, the ML
scientist needs to design ways to model thenormal situation using ML models, and then train
the model with a large amount of normal data.
After that, the model is applied to label newcases; if the cases have a very small chance to fit
with the normal model, the cases are reported asanomalies. In short, anomaly detection systems
based on unsupervised learning make a decision(normal/abnormal). Some refer to unsupervised
learning applications as ‘one-class problems.’
As you might imagine, systems based on
unsupervised learning can generate a lot of falsepositives, because a situation deemed abnormal
can be perfectly innocuous (think vulnerability

www.stellarcyber.ai

sales@stellarcyber.ai

scanner again). Anomaly Detection is goodat detecting things that are different, but notnecessarily always malicious. This is a problem
that security analysts still struggle with today.

The Rise of Big Data
After 2000, developers and researchers began
creating anti-spam, anti-phishing, and URL
filtering systems based on supervised learning.
In supervised learning, decisions are learned
from a set of labelled data. The labels specify thenormal case and perceived threats. One such
example is a URL classifier. First, large datasetsof benign URLs and malicious URLs are used totrain a URL classifier. Then, the URL classifier isdeployed and matches the URLs extracted fromincoming e-mails, and for each input URL, theURL classifier will produce a label to tell whether
it is benign or malicious. A supervised learningalgorithm analyzes the data and produces
an inferred function (i.e., this traffic behavior
matches this input data, therefore it is bad),which can be used for mapping new examples.
Early filtering systems using supervised learning
were based on relatively small datasets, but
datasets have grown in size and sophistication
with the advent of Big Data. For example, Gmail
employs an Internet-scale dataset to train nitsclassifier to improve accuracy. Such a large
scale, using Big Data and huge computation
resources, enables Google to train moresophisticated models.
Big models (in terms of the number ofparameters) based on Big Data, such as deeplearning models, have gradually become more
popular. For example, supervised ML has
been successfully used in anti-virus signature
generation for years, and in 2012, Cylance beganoffering next-generation anti-virus systems
based on datasets other than signatures, suchas anomalous traffic behavior. The advantage
of ML-based methods compared with simple
signature matching is that the ML-based method
might find similar but not exactly identical cases,
while signature matching looks for exact thesame pattern.

Combining Supervisedand Unsupervised Learning
Supervised learning has shown more successin security applications, but it requires easy
access to large sets of labelled data, which arevery difficult to generate for cyberattacks suchas APT (advanced persistent threats) and zeroday attacks targeted at enterprises. Therefore,
we cannot easily apply supervised ML to solve
all cyberattacks.
This is where unsupervised learning comes backinto the situation. We need to develop moreadvanced AI/ML that can be unsupervised orsemi-supervised (e.g., through adaptive learning)
to solve the additional cybersecurity challenges.
Adaptive learning (human-guided analysis)
coupled with unsupervised learning improves
your ability to detect those APTs and zero-day
exploits. Unlike in supervised learning, where
we need to label a large number of attack cases,
adaptive learning leverages limited guidancefrom humans to drive the direction or preferenceof the anomaly detection to produce moreaccurate results.

A New Direction: Connecting the DotsOne of the big problems with simple anomaly
detection is the volume of false positives, andeven if the results are indeed accurate, theresults are lacking context for a security analyst
to quickly evaluate the impact to the security
posture and gear resources towards them.
One way to address this issue is by correlating
multiple events (dots) and then evaluating
whether or not the correlation indicates a strong
signal for a cyberattack. For example, one ‘dot’
might be an executive logging into the network
at 2AM, and while this alone might be seen as afalse positive, it wouldn’t be enough to trigger analert. However, if the executive is seen logging
in at 2AM from an IP address in Russia or China,
and it is running a PowerShell command theexecutive should not know, it would triggeran alert, because enough dots linked together
providing the context indicate that it is more
like an account takeover, and some hacker iswww.stellarcyber.ai

sales@stellarcyber.ai

pretending to be the executive, but logging inat an usual time and from an unusual place
to do unusual things.

constitute a threat. This approach significantly
reduces false positives and helps analysts
identify APTs or zero-day attacks more quickly.

One fundamental new trend in ML/AI
community is to let the ML algorithm deal
with graphs. Graphs with nodes and edges are
perfect for tracking relationships and expressing
contexts. However, traditionally, graphs are
considered as discrete data structures. On theother hand, in order to apply gradient descentoptimization for ML, usually the data needs tobe continuous and differentiable. In recent years,
there are quite a few new breakthroughs on ML
to deal with graphs. Such techniques can becalled graph representative learning or Graph
ML in short. Applying such techniques into
products, Stellar Cyber’s Open-XDR platform
correlates multiple events and evaluates
whether, when looked at together, theyWith Graph ML, we can correlate and groupalerts into incidents, which will significantly
reduce the number of cases which need to beinvestigated individually. Furthermore, with thecorrelation and grouping, incidents have moredetails and graph ML also can help provide aranking or score to let the SoC team betterfocus on significant incidents more quickly. The
resulting incident graphs are also a natural way
to present the attack context with a timeline.
With these approaches, SoC efficiency canbe fundamentally improved to cure alert
fatigue problems.

[1] Information Risk Management, “Risky Business,” 2019.
[2] D. E. Denning, “An Intrusion-Detection Model,” IEEE Transactions on Software Engineering,
vol. 13, no. 2, pp. 222–232, 1987.
[3] R. Lippmann, R. K. Cunningham, D. J. Fried, I. Graf, K. R. Kendall, S. E. Webster, and M. A. Zissman, “Resultsof the 1998 DARPA Offline Intrusion Detection Evaluation,” in Proc. Recent Advances in Intrusion Detection, 1999.

Stellar Cyber’s Open XDR platform delivers Everything Detection and Response by ingesting data from all tools,correlating incidents across the entire attack surface, delivering high-fidelity detections, and responding to threats
automatically through AI and machine learning. Our intelligent, next-gen security operations platform greatly reduces
enterprise risk through early and precise identification and remediation of all attack activities while slashing costs,
retaining investments in existing tools and accelerating analyst productivity. Typically, our platform delivers a 20X
improvement in MTTD and an 8X improvement in MTTR.

www.stellarcyber.ai | sales@stellarcyber.ai
www.stellarcyber.ai

sales@stellarcyber.ai