Which problems in information security can be solved better using neural networks?

Question

Information security has become a thriving field during the last years. It is a broad domain ranging from planing and building over testing to operating different applications, systems and networks in a secure fashion. From small embedded systems to large scale enterprise applications, security is always an important challenge.

With some exceptions, I have hardly seen neural networks used in this domain to tackle those challenges. The most common exception is breaking CAPTCHAs with CNNs during penetration testing, analysis of network traffic and malware/spam detection.

What are other problems in information security that could be solved better with neural networks than with classical algorithms? Please include an explanation why those problems would benefit from neural networks.

Answer 1

The most natural place where artificial networks can be used in information security is in attack detection.

The security team leaders of more than one web hosting company told me the same story. Their teams' daily challenges are to defend against the attacks mounted continuously by several overseas teams against the IT security of their hosting infrastructure. Attack teams specialize in one target hosting company, and there are often many attack teams on one defensive security team.

The hosting company security teams try to preemptively defend the assets of their companies from attacks. These teams also have to restore their hosting system with minimal impact on hosted sites whenever an attack achieves its goal, which may be data corruption, data theft, the insertion of malware, or some other manipulation.

The primary mechanism for preemptive defense is detection of an attacker and an ascertaining the attack's intended target within the hosting infrastructure's defenses, after which known blocks to these attacks are employed, such as IP or MAC filters, modification of access rights, upgrades that plug known security holes, or other measures.

The progress of attacks occur across some set of changing fronts, as in a war or a game of chess. Information security may soon become largely a game between two sets of computer systems. One trying attacks, and the other trying to detect and block them.

For the defending team, high speed, real time detection of the attack is key. A properly designed deep learning solution, configured and integrated into a defensive system, is more likely to block an attack than a person watching a dashboard of log file stats and system metrics. A deep network could also be trained to discover the subsystem or specific defense against which the attack is intended.

Once detection occurs, the application of patches, exclusion filters, and denial criteria may best be accomplished through a rules based system.