{"id":4388,"date":"2018-06-13T11:19:04","date_gmt":"2018-06-13T18:19:04","guid":{"rendered":"https:\/\/www.acalvio.com\/?p=4388"},"modified":"2018-06-13T11:19:04","modified_gmt":"2018-06-13T18:19:04","slug":"using-deep-learning-for-information-security-part-1","status":"publish","type":"post","link":"https:\/\/acalvio.p2staging.us\/index.php\/2018\/06\/13\/using-deep-learning-for-information-security-part-1\/","title":{"rendered":"Using Deep Learning for Information Security &#8211; Part 1"},"content":{"rendered":"<p><span style=\"font-weight: 400;\"><b>Authors:B Balamurali A R andB <span class=\"il\">Satnam<\/span>B Singh<\/b><\/span><br \/>\n<span style=\"font-weight: 400;\"><br \/>\nPost Web 2.0, data generated on the internet has increased manifold. This has led to the use of data driven approaches to solve many traditional problems across different industry verticals. Among them, deep learning-based (DL) approaches have been quite impactful in recent times. B With powerful yet inexpensive hardware enabling millions of calculations to optimize parameters, DL algorithms have been successfully tackling problems in vision, language, operations research etc., to name a few. <\/span><br \/>\n<span style=\"font-weight: 400;\">Deep learning is a type of machine learning that learn from experience and understand the world in terms of a hierarchy of concepts [<\/span><a href=\"https:\/\/ieeexplore.ieee.org\/document\/7176097\/\"><span style=\"font-weight: 400;\">1<\/span><\/a><span style=\"font-weight: 400;\">, <\/span><a href=\"https:\/\/www1.icsi.berkeley.edu\/~sadia\/papers\/ccs-webfp-final.pdf\"><span style=\"font-weight: 400;\">2<\/span><\/a><span style=\"font-weight: 400;\">]. It applies different neural network architectures to learn the concepts from a large data samples over time using a lot of parallel computations. Deep learning is an advanced representational learning that learns complicated concepts by building a graph of many deep layers each representing simple concepts in a hierarchy. With more context available, the deep learning-based systems perform even better than human. It has made significant advances in the problems where the accuracies were weak, and real-world usage was impossible. For example, classifying images, identifying objects, translating speech, automatically tagging photos, etc. In these applications, deep learning has made a significant improvement in achieving high accuracies, and therefore it is now used in online advertising, search engines, chatboxes, video games, computer vision, robotics, finance, and bioinformatics, and genomics. <\/span><br \/>\n<span style=\"font-weight: 400;\">Deep learning is not a silver bullet that can solve all the InfoSec problems because it needs extensive labeled datasets and no such labeled datasets are readily available. However, there are several InfoSec use cases where the deep learning networks are making significant improvements to the existing solutions. <\/span><br \/>\n<img loading=\"lazy\" class=\"wp-image-6474 aligncenter\" src=\"https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/satnam-dl1-image1-1024x455.png\" alt=\"\" width=\"600\" height=\"267\" srcset=\"https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/satnam-dl1-image1-1024x455.png 1024w, https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/satnam-dl1-image1-300x133.png 300w, https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/satnam-dl1-image1-768x341.png 768w, https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/06\/satnam-dl1-image1.png 1346w\" sizes=\"(max-width: 600px) 100vw, 600px\" \/><\/p>\n<h5 style=\"text-align: center;\"><b><i>Figure 1<\/i><\/b><i><span style=\"font-weight: 400;\">: Use Cases of Deep Learning in Information Security<\/span><\/i><\/h5>\n<p><span style=\"font-weight: 400;\">As discussed earlier, deep learning requires a significant amount of labeled data which is not easily obtained in the information security Industry. Figure 1 shows some of the widespread use cases of deep learning in InfoSec. Malware detection and network intrusion detection are two such areas where deep learning has shown significant improvements over the rule-based and classic machine learning-based solutions.<\/span><br \/>\n<span style=\"font-weight: 400;\">Advent of SIEMs and active system logging has enabled InfoSec industry to embrace machine learning based approaches to detect security breaches and other malicious activities. We at Acalvio dabble with data to bring interesting use cases to aid the needs of the business. In fact, it has been ingrained in our genes to think and devise solutions based on advanced machine learning. In this blog we focused on how deep learning can be leveraged to address specific use cases that link security logs and deception technology. <\/span><span style=\"font-weight: 400;\">We present a white paper focusing on some of the Information Security (InfoSec) use cases that can be enabled through deep learning. We focus on the following:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Introduce deep learning to InfoSec community with use cases they can relate to. <\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Introduce deep learning architecture and nuances related to it. <\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Introduce Feed Forward network (FFN) and anonymous traffic detection problem. How FFN can be leveraged to detect TOR traffic detection.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Introduce convolutional neural network and how it can be used for InfoSec use cases.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">Introduce sequence labelling InfoSec tasks. How recurrent neural network and long short-term memory network can be used to detect C&amp;C domains.<\/span><\/li>\n<li style=\"font-weight: 400;\"><span style=\"font-weight: 400;\">We also look at the interesting problem of parameter optimization in DL systems. We use auto-ml framework explore and optimize the parameters.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400;\">The white paper on detecting Tor traffic using deep learning can be downloaded from here:B <\/span><a href=\"https:\/\/acalvio.p2staging.us\/wp-content\/uploads\/2018\/07\/Detecting-Anonymised-Network-Traffic-using-Deep-Learning.pdf\">Detecting Anonymised Network Traffic using Deep Learning<\/a><span style=\"font-weight: 400;\">. <\/span><br \/>\n<span style=\"font-weight: 400;\">Acalviob\u0000\u0019s <\/span><a href=\"https:\/\/www.acalvio.com\/product\/\"><span style=\"font-weight: 400;\">Shadowplex<\/span><\/a><span style=\"font-weight: 400;\"> lures attackers and malware alike to dynamically deployed deceptions with artificially induced vulnerabilities. It is an enticing prospect for attacker or malware to exfiltrate data or contact C&amp;C from there. Our threat detection engines, can detect the data exfiltration and thus thwart the attack as well as capture more information about the adversary and the tools, techniques used by him. Please contact us for your queries regarding our solutions and products. <\/span><br \/>\n<b>References:<\/b><br \/>\n<span style=\"font-weight: 400;\">[1] He, G., Yang, M., Luo, J. and Gu, X., b\u0000\u001c<\/span><a href=\"https:\/\/ieeexplore.ieee.org\/document\/7176097\/\"><span style=\"font-weight: 400;\"> Inferring Application Type Information from Tor Encrypted Traffic<\/span><\/a><span style=\"font-weight: 400;\">,b\u0000\u001d Advanced Cloud and Big Data (CBD), 2014 Second International Conference onB (pp. 220-227), Nov. 2014.<\/span><br \/>\n<span style=\"font-weight: 400;\">[2] Juarez, M., Afroz, S., Acar, G., Diaz, C. and Greenstadt, R., b\u0000\u001c<\/span><a href=\"https:\/\/www1.icsi.berkeley.edu\/~sadia\/papers\/ccs-webfp-final.pdf\"><span style=\"font-weight: 400;\">A critical evaluation of website fingerprinting attacks<\/span><\/a><span style=\"font-weight: 400;\">,b\u0000\u001d Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications SecurityB (pp. 263-274), November 2014<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Balamurali A R andB SatnamB Singh &#8211; Post Web 2.0, data generated on the internet has increased manifold. This has led to the use of data driven approaches to solve many traditional problems across different industry verticals. <\/p>\n","protected":false},"author":2,"featured_media":4522,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[3],"tags":[60,90,117],"_links":{"self":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/4388"}],"collection":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/comments?post=4388"}],"version-history":[{"count":0,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/posts\/4388\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media\/4522"}],"wp:attachment":[{"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/media?parent=4388"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/categories?post=4388"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/acalvio.p2staging.us\/index.php\/wp-json\/wp\/v2\/tags?post=4388"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}