[Dailydave] Machine Learning and Dimensions and stuff

shadown [at] gmail shadown at gmail.com
Sat Nov 22 04:30:23 EST 2014


Willie, could you elaborate?
I'm interested in details, from vague statements we don't learn anything new. Please remember this is not the physical world, and very different rules apply.

Cheers,
  Sergio

> On 21.11.2014, at 22:19, William Kupersanin <wkupersa at gmail.com> wrote:
> 
> 
> The implications are though, that even if the adversary adapts, that the ML analytic is forcing the adversary to operate in a smaller space to avoid appearing anomalous. I consider anything that can shift the balance of cost from the defender to the adversary to be wildly successful. 
> 
> --Willie
> 
>> On Thu, Nov 20, 2014 at 5:25 PM, Halvar Flake <HalVar at gmx.de> wrote:
>> Hey all,
>>  
>> thanks for the link, and it is indeed a fun talk :-)
>>  
>> An important detail that many people in "machine learning for security" neglect is that the vast majority
>> of ML algorithms were not designed for (and will not function well) in an adversarial model. Normally,
>> one is trying to model an unknown statistical process based on past observables; the concept that the 
>> statistical process may adapt itself with the intent of fooling you isn't really of interest when you try to
>> recognize faces / letters / cats / copyrighted content programmatically.
>>  
>> For entertainment, I think everyone that plays with statistics / curve fitting / machine learning in our field
>> should have a look at two things:
>>    
>>     http://cvdazzle.com/ - people trying crazy makeup / hair styles to screw with face detection.
>>     http://blaine-nelson.com/research/pubs/Huang-Joseph-AISec-2011 - a riot of a paper that introduces "Adversarial Machine Learning"
>>  
>> This doesn't mean that you can't have huge successes temporarily using ML / curve fitting / statistics;
>> attackers haven't felt the need to adapt to anything but AV signatures and DNS blacklisting yet, so relatively simple 
>> ML will have big gains initially. I suspect, though, that a really important part of using ML for defense in any form
>> is "not becoming an oracle" - which is often counter to commercial success. It may be that the only good, long-term
>> ML-based defense is one that can't be bought.
>>  
>> Cheers,
>> Halvar
>>  
>>  
>>  
>>  
>> Gesendet: Donnerstag, 20. November 2014 um 19:16 Uhr
>> Von: "Dave Aitel" <dave at immunityinc.com>
>> An: dailydave at lists.immunityinc.com
>> Betreff: [Dailydave] Machine Learning and Dimensions and stuff
>> https://vimeo.com/112322888
>> 
>> Dmitri pointed me at the above talk which is essentially a good
>> specialized 101-level lecture on how machine learning works in the
>> security space.
>> 
>> There's not much to criticize in the talk! (It has a lot of the features
>> of El Jefe!) They use a real graph database to run their algorithms
>> against process trees - but if you wanted to heckle you'd ask "Doesn't
>> the CreateProcess() system call also take "parent process" as an
>> argument? What IS the rate of false positives? Because if you can't get
>> it down to basically 0 then you are essentially wasting your time? etc." :>
>> 
>> But again, nobody asked any hard questions - and while the talk nibbled
>> around the edges of the tradeoffs with using machine learning techniques
>> on this kind of data, it didn't go into any depth at all about which
>> ones they've tried and failed at. It's a technical talk, but it's not a
>> DETAILED talk in the sense of "Here's some outliers that show us where
>> we fail and where we succeed and perhaps why".
>> 
>> That said, if you don't have a plan to do this sort of thing, then
>> you're probably failing at some level, so worth a watch. :>
>> 
>> -dave
>> 
>> 
>> _______________________________________________
>> Dailydave mailing list
>> Dailydave at lists.immunityinc.com
>> https://lists.immunityinc.com/mailman/listinfo/dailydave
>> 
>> _______________________________________________
>> Dailydave mailing list
>> Dailydave at lists.immunityinc.com
>> https://lists.immunityinc.com/mailman/listinfo/dailydave
> 
> _______________________________________________
> Dailydave mailing list
> Dailydave at lists.immunityinc.com
> https://lists.immunityinc.com/mailman/listinfo/dailydave
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.immunityinc.com/pipermail/dailydave/attachments/20141122/d3186d19/attachment-0001.html>


More information about the Dailydave mailing list