In this special guest feature, Mike Paquette, VP of Products at Prelert, highlights how forward-thinking organizations see machine learning as an absolutely essential component to detecting today’s advanced cybersecurity threats early. Mike has more than 30 years of technology product development experience, including executive roles with several startups in the areas of consumer apps, mobile app ecosystems, and Security Information and Event Management (SIEM). Previously, he spent more than a decade in executive roles developing and bringing to market network intrusion prevention and DDoS defense solutions at Top Layer Security (acquired by Corero in 2011). He is co-author of a patent on DDoS defense.
For forward-thinking organizations, advanced security analytics powered by machine learning is more than just a pipe dream: it’s an absolutely necessary component to identifying security issues early. This is especially critical when you consider what’s at stake. If the recent high-profile breaches have taught us anything, it’s that no organization is immune to an attack, even those that don’t specifically deal with monetized data.
As companies continue to invest in generating, storing and protecting critical data, hackers are taking notice by identifying new ways to infiltrate systems. With more data being produced than the human brain has the capacity to monitor, potential threats are going unnoticed. Even an army of analyst experts would be unable to accomplish what unsupervised machine learning can do.
Replacing the legacy safeguards that have failed to protect networks and applications, machine learning is at the heart of IT’s shift in mindset. It’s no longer about preventing attacks or focusing on “known threats,” but rather identifying potential threats early enough so that they don’t have an opportunity to cause real damage. Without the proper tools, it can take companies months to discover a data breach and even more to resolve it. By failing to detect potential threats early, organizations like Home Depot, J.P. Morgan and Ashley Madison put their finances, reputation and relationship with valued customers at risk.
Creating a Baseline for Normal
As IT environments grow increasingly complex, it’s become nearly impossible for even the most experienced IT experts to gauge whether activity is normal or malicious. Even if this could be determined with human expertise, it would still be difficult to create threshold and alert rules precise enough to flag similar activity moving forward, without inundating IT with false alerts. This is where machine learning shines.
With the ability to study each system’s unique behavior, unsupervised machine learning can create a baseline for normal to which it compares all network and application activity in order to determine the likelihood of an attack. Further, the technology is able to grow with organizations by constantly working to recognize new and existing patterns within huge volumes of data. This means, for example, that behaviors that were once perceived as anomalous can eventually be marked as normal if an organization sees the activity as a necessary component to conducting business.
Identifying Anomalous Activity
Without human intervention, unsupervised machine learning does all of the heavy lifting in order to identify potential security issues. It does this by processing millions of data points each minute and automatically identifying anomalous behavior. It then correlates anomalies across multiple data sources to determine their potential impact.
Similar to finding a needle in a haystack, this ensures that the right alerts are flagged, rather than thousands of alarms being sent for low-impact activity.
Prioritizing High-Impact Alerts
It’s no secret that IT departments are flooded with tens of thousands of alerts every day, which can often lead to alert fatigue. With too many alerts to sift through, there’s an increased likelihood that signs of malicious activity can be buried or even missed entirely.
Rather than leveraging human intelligence alone, combining machine learning with anomaly detection helps organizations to successfully detect breaches by reducing the number of false positives – and automatically prioritizing alerts with the highest potential impact. In fact, 90 percent of organizations that use advanced security analytics have seen a decrease in false alerts or an improvement in actionable alerts, according to EMA.
For these organizations, machine-powered advanced security analytics is so much more than just marketing spin—it’s the only technology capable of keeping up with the pace at which attacks (and attackers) are evolving. By fundamentally changing the way that big data is analyzed, IT teams are able to monitor larger and smarter sets of data in real-time to prevent a data breach from being catastrophic.
Sign up for the free insideBIGDATA newsletter.
Speak Your Mind