Machine Learning Forensics

Abstract

Machine learning (without human interference) can collect, analyze, and process data. In the case of cyber security, this technology helps to better analyze previous cyber-attacks and develop respective defense responses. This approach enables an automated cyber defense system with a minimum-skilled cyber security force. There are high expectations for machine learning (ML) in cyber security, and for good reasons. With the help of ML algorithms, we can sift through massive amounts of security events looking for anomalies, deviations from normal behavior that are often indicative of malicious activity. These findings are then presented to the analyst for review and vetting, and the results of his determination fed back into the system for training. As we process more and more data through the system, it evolves: it learns to recognize similar events and, eventually, the underlying traits of malicious behavior that we're trying to detect. This chapter explores machine learning forensics.