Cyber Analytics Machine Learning For Computer Security

Cyber Analytics – Machine Learning for Computer Security Arpitha Ramachandraiah, Team CRYPTERS, UBID: 5016 6499 Cyber security is in the forefront of every organizations’ core strategy to protect its data and information systems. This increased awareness about cyber security has been driven partly due to the increasing number of cyber-attacks and also due to the various government regulations such as HIPAA, SOX, PCI and so forth. Unlike in the past, attacks on organizations are more targeted, organized and sophisticated and the target of these attacks on organizations are to obtain proprietary and sensitive information. The exponential growth in the number of cyber-attacks can no longer be contained using static, existing standard security†¦show more content†¦Machine Learning uses algorithms for mainly two reasons: one is to predict new data and second, to analyze existing data. In the first case, once data is gathered, algorithm is applied on it to predict something new about this data. An application of this in the field of computer security could be prediction of userâ€⠄¢s current session based on the information available in the audit logs. While in the second case, once data is gathered and algorithm applied, it is used to gain fresh insights into the data which could not have been obtained without having an algorithm that is powerful enough to process such a large and complex chunk of data. An example of this in computer security will be understanding of a user’s high CPU usage when compared to others without terming it bad, based on the algorithmic output obtained about the user from the audit logs. Together with data science, machine learning can be used to gain hidden insights into data and to build predictive models to process new data. A couple of security areas where machine learning can be applied in the arena of cyber security are: 1) Network Security: Here, machine learning can be leveraged to build models to find patterns in traffic that is used to distinguish benign traffic from malicious traffic that signals criminal activity. It is also possible to detect malicious software such as viruses,