Threat Intelligence Firms Look to AI, but Still Require Humans

Threat intelligence firms are racing to expand their machine-learning capabilities to capture more of the un-indexed parts of the internet, but somewhat ironically, human analysts and experts remain critical to the effort. 

Last week, startup Resecurity announced its intent to index the entire dark web by 2020—petabytes of information. The effort would use machine learning and big data technologies, but Resecurity also specifically called out the necessity of human analysts.

The same week, rival threat intelligence firm Flashpoint announced an expansion to its service, adding more dark-web sources, underground marketplaces and encrypted forums. While the capabilities are fueled by advances in machine learning, human analysts remain key, says Flashpoint CEO Josh Lefkowitz.

"There is a tenuous and temporary nature to many of these sources, and that is what necessitates the agility of human involvement because the actors are constantly moving around," Lefkowitz says.

The amount of data created by companies has exploded as more enterprise infrastructure connects to the internet and produces logging information and other data. The availability of data on every facet of the business—and on consumers' habits—has powered the application of machine learning and artificial intelligence to a variety of new use cases.

Threat intelligence has quickly become a way for companies to keep abreast of vulnerabilities that impact their systems, breaches that affect their customers, and potential attacker interest. More than half of companies are using threat intelligence to improve their detection of attacks, according to a recent report from CyberEdge. A similar majority also used threat intelligence to help validate security alerts and signs of an attack and reduce the workload on their analysts, the same report stated.

"It is a two-pronged approach—you want to have a lot of tools in your toolbox," says Daniel Hatheway, senior technical analyst at digital intelligence firm Recorded Future. "It is more about creating transparency around what dangers the dark web does pose."

Most threat intelligence firms are focused on expanding access to the types of information which matter to clients. Flashpoint, for example, just announced that the company has added more robust vulnerability data, compromised account data from underground shops, and information from secured and encrypted forums.

To access that last category and refine the other data sets, they need human analysts, Lefkowitz says.

"If you just have automated scrapers that are spidering the entirety of the onion network—when the reality is that many of these environments are password-protected and they necessitate invite links that you receive because of your credibility and reputation in the community—you are missing so much if you are just relying on automation," he says.

Employees and threat analysts are, of course, expensive. So companies continue to look for ways to automate as much of the process as possible. Resecurity, for example, has focused on capturing as much of the dark web as possible for later inspection by clients and analysts.

"There have been attempts in the past to scan the dark web, but the tools that were available when those efforts were undertaken were extremely primitive," Gene Yoo, chief executive officer of Resecurity, said in a statement. "They generated a lot of false positives and noise—and not a lot of truly actionable intelligence. To deliver the maximum visibility into the dark web, to get to the point where we can associate a particular threat actor with his real identity, we need to apply the power of data science and big data."

Relying on humans for security is nothing new. The majority of companies heavily rely on employees to identify threats, with 85 percent of firms saying employees fill a significant role in their defense against cyber attacks, according to a survey conducted by security firm Glasswall Solutions. In fact, more than 40 percent of companies surveyed by Glasswall Solutions stated that they were "completely reliant on employees as their last line of defense," Glasswall stated in a release published along with the report.

It's unlikely that threat intelligence firms will ever be able to do away with human analysts. In fact, as companies' web scraping systems produce more potential alerts, connecting disparate pieces of information, the demand for analysts will likely increase.

"Part of this is recognizing that illicit actors continue to diversify where they are operating, necessitating an expansion in the aperture of our collections, of our capabilities," says Flashpoint's Lefkowitz. "It is that chess game, that cat-and-mouse game, … and we are only seeing that trend continue now as more technologies are at their fingertips that let them pursue their illicit goals."

Related Links

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.