784 karma · joined January 7, 2011
Ah, thanks for the reference, DD author here, the funny fact about the name is that translated to my mother tongue (French), it sounds like porn ;)
This is much older than the 9th of August.
See the Microsoft / Kaggle challenge on classifying malware families, winning solution is > 99% accuracy IIRC.
There are some reports from Google as well that you may find around, and at least at the time (few years back) they make the same observation we do with my coworkers: the rate of false positive remains high, and thus it is the job of trained security operators to spot the sophisticated attacks.
Empowering the operators with more data mining tools is a good step not yet fulfilled I believe.
The main differences with straight 'supervised' machine learning are the lack of labels, and the unreal volume of data (cheaply produced by machines, in machine time, we're talking microseconds to milliseconds here). So unsupervised learning is king in this domain, and often security operators have to keep an eye on and interpret the results. Another difference with other fields is that datasets are rare, mostly because of privacy as the logs can be very revealing. For this reason the market exhibits a lock that cannot be overcome by everyone I believe. Basically, you sort of need to be in the place already.
Here is a recent very high level survey on the topic (a TC report, not that bad for once), https://techcrunch.com/2016/07/01/exploiting-machine-learnin...
Here are two of our own Open Source tooling we use the most in application:
- very efficient C++ map-reduce feature generation for logs (for ML and analytics): https://github.com/soprasteria/cybersecurity-miw
- machine learning / deep learning server: https://github.com/beniz/deepdetect
The ML cybersecurity + infosec field is still young, but moving very fast, a lot of new startups and (somewhat opaque) products.
Code is here: https://github.com/beniz/deepdetect
There are differenciated CPU and GPU docker versions, and as mentioned elsewhere in this thread, they are the easiest way to setup even production system without critical impact on performances, thanks to nvidia-docker. It seems they are more popular than AMI within our little community.
The character-based net reads the URL, not the website. The common alphabet used in the model made public is of size 69, URL length can be for example 256.
Not only this is below the image size you are talking about, but after the first convolution the alphabet (in one-hot vector encoding) is collapsed, which leaves convolutions across length 256 in 1D.
Not that terrible. In proxy-like territory, passing batches of URLs to the GPUs could pave the way to new ad-blockers at large. To be tested :)
EDIT: of possible interest is that these models output a probability and possibly a confidence of having a URL blocked. Base on these, an blocker could ask for confirmation.
They are not easily gamed either: they learn features as convolutional filters over the characters. These filters are more powerful than ngrams, as complex as the filters you may have seen for images.
Now, about gaming the nets, there's an issue, which is the same as for image-based CNNs: some combinations of letters (or pixel) do exist that do not make a difference to the eye, but push the classifier into the wrong class. However, in order to find these combinations, having a first-hand on the underlying neural net and its weights is mandatory.
The interesting gain here is that there's no more conflicting regex nor optimization to work on huge lists of blocking rules. Instead, URLs can be passed to the network in batches.
I have conducted my own set of experiments and a usable deep model is available (see http://www.deepdetect.com/applications/text_model/ ).
This is kinda shameful plug, but I'm really interested in feedback on these new ways of ad blocking with high accuracy.
For sure running a deep net service is not as easy as installing ublock but there are ways. The whole source code is Open Source, as is the model. I have more data at hand, and some larger models could be built. Performance assessment would be a good next step as well.
EDIT: the linked page is rather long, lookup 'Novel task' to get to a quick classification example
Set it up remotely and you basicially have your own DDG.
In my view, these frameworks are like programming languages, you do need to pick a new one up from time to time, but you can do most of the things with all of them.