How to use Machine Learning Against web app Attacks

Web applications have become a major target for cybercriminals, and the size and implications of the threat calls for drastic measures, like using machine learning to enhance security systems.

In most cases we rely on antivirus software and security apps to protect our computers and devices. However, these solutions will not stop a hell-bent hacker and, worse, they can even be used to disseminate malware across the internet.

And, as we’ve discovered lately, most popular antivirus software can’t get in the way of CIA cyber spies.

On the cloud, the situation is more critical as just pretty much everybody uses web applications which hold huge amounts of valuable data, which, of course, is drooled over by hackers.

The Cloud, Playground for Cybercriminals

Cloud computing enables organizations of any size to be more efficient in all aspects of the business: by reducing costs, streamlining management and the opportunity to reach a much wider audience.

Unfortunately, the cloud also does offer an efficient opportunity for hackers. Web applications are open and can be accessed from anywhere in the world, which makes them a prime target for hackers who exploit any breach in order to get sensitive business data.

“75% of all cyber attacks target web applications”

A cyber attack on web applications could be much more devastating than a simple hack of an internal server. Since these apps are in constant contact with its customers and partners, a single attack could compromise the entire network.

The increasing number of cloud-targeted cyber attacks confirms a new trend in which the cloud has become the new playground for cybercriminals.

According to a datasheet from cybersecurity firm Imperva, 75% of all cyber attacks target web applications, with web-based vulnerabilities accounting for over 80% of all security vulnerabilities discovered.

The majority of web applications (82%) suffer from critical vulnerabilities, with developers more busy, well, “developing” than addressing cybersecurity issues.

Next Phase in Cyberwar: Cognitive Security or Machine vs Human

As it stands, cyberwar involves humans on both sides: attackers looking for breaches and flaws in the system, and defenders trying to anticipate or assess their moves to release the next update of the software.

Training more cybercrime professionals and hiring more security staff won’t be enough, because humans, no matter how many or trained they are, simply can’t face the current (and future) scale of cyber threats.

And this is where machine learning algorithms can come in handy: they can analyze security events almost in real-time, discover patterns and learn about the ever-changing security threats.

AI-based defense systems would help security teams manage security threats and find ways to counter them more efficiently.

In the event of a cyber attack, time and precision are decisive, and these two elements could be greatly improved by a cognitive system that can quickly process considerable volumes of data.

IBM is training Watson to become a cognitive assistant that develops an expertise in analyzing threat data, search reports, web text, and other structured and unstructured relevant data from white papers, blogs and forums.

How to Integrate Machine Learning Into Your Security System

First, machine learning systems need data, the more the better, to self-learn, evolve and gain in efficiency.

You need to hire data scientists who would create a training set for the AI to work on. They would also curate and label data sets so that the AI model easily finds the right knowledge.

Once the model is up and running, and has completed primary training, experts must test it in real environment and assess its performance to address any shortcoming.

Granted, this is easier said than done and requires a lot of resources, but nowadays it’s much easier to implement AI tech thanks to the cloud.

For example, IBM has a lot to offer for enterprises in that regard like the open source Hortonworks platform which enables building AI models, and Apache Spark, an open-source cluster computing framework, and many other solutions.

What are some benefits and/or drawbacks of using machine learning to enhance cybersecurity systems?