Security Pros' Painless Guide to Machine Intelligence, AI, ML & DL

In the hands of enthusiastic marketing departments, the terms "artificial intelligence," "machine learning," and "deep learning" have become fuzzy in definition, sacrificing clarity to the need for increasing sales. It's entirely possible that you'll run into a product or service that carries one (or several) of these labels while carrying few of its attributes. 

Talk of machine intelligence can often lead to its own special rabbit-hole of jargon and specialized concepts. Which of these will form an important part of your future security infrastructure — and does the difference really matter?

Three Branches
Broadly speaking, machine "intelligence" is a system that takes in data, produces results, and gets better — faster, more accurate, or both — as more data is encountered. Within the broad category are three labels frequently applied to systems: machine learning, deep learning, and artificial intelligence. Each has its own way of dealing with data and providing results to humans and systems.

The differences between how the three function make them appropriate for different tasks. And the sharpest difference divides AI from the other two. Put simply, AI can surprise you with its conclusions, while the other two can "only" surprise you with their speed and accuracy.

Machine Learning
Machine learning uses statistical models (often marketed as "heuristics") rather than rigid algorithmic programming to reach results. Looked at from a slightly different perspective, machine learning can use an expanding universe of inputs to achieve a specific set of results.

There are many techniques that fit within the category of machine learning. There are supervised and unsupervised learning, anomaly detection, and association rules. In each of these, the machine can learn from each new input to make the model on which it bases its actions richer, more comprehensive, and more accurate.

With all of these, the key is "a specific set of results." For example, if you wanted a machine learning system to differentiate between cats and dogs, you could teach it all kinds of parameters that go into defining cats and dogs. The system would get better at its job given more data to build its models, and ultimately could predict — based on an ear or a tail — whether something was a dog or cat. But if you showed it a goose, it would tell you it was a cat or dog because those are the only options for results.

When the goal is sorting diverse input into specific categories, or directing specific actions to be taken as part of an automation process, machine learning is the most appropriate technology.

Deep Learning
Deep learning stays within the realm of machine learning, but in a very specific way. "Deep learning" implies that neural networks are the family of techniques being used for processing. While neural networks have been around for quite a while, developments in the last decade have made the technique more accessible to application developers.

In general, neural networks today used a layered technique to pass input through multiple layers of processing. This is one of the ways in which the neural network is designed to mimic animal intelligence. And that mimicry makes neep learning applicable to a wide range of applications.

Deep learning is frequently the technology behind speech recognition and image recognition applications outside of security. Within security, deep learning is often seen in malware and threat detection systems. The number of connections between nodes in the neural network (which can range up into the hundreds of millions) make deep learning a technique often used in applications where most of the learning and processing happens in a central, cloud-based system, with the application of that learning performed at the network's edge.

To use our earlier examples, deep learning would also be able to learn how to tell cats from dogs, and could be trained to tell breeds of dogs apart, as well as breeds of cats. It could even get to the point of being shown mutts (or "All-American Dogs" as the American Kennel Club dubs them) and assigning them a likely breed based on physical characteristics. But it would still be separating cats and dogs — the poor goose would still be left out in the cold.

Artificial Intelligence
Both machine learning and deep learning involve systems that take an expanding set of data and return results within a specific set of parameters. This makes them technologies that can readily be incorporated into automation systems. Artificial intelligence, on the other hand, is capable of reaching conclusions that are outside defined parameters. It can surprise you with the results it finds.

If you ask many academic AI researchers, they will say that there is no "real" AI on the market today. By this, they mean there's no general AI — nothing that remotely resembles HAL from "2001" or the Majel Barrett-voiced computer in Star Trek.

There are, however, AI systems that apply advanced intelligence to specific problems. IBM's Watson is the most widely known, but there are many application-specific AI engines in use by various vendors. Much of the concern about "deep fake" audio and video is fed by AI capabilities used in different applications and services. Robotics, including autonomous vehicles, are another.

To complete our example, an AI system would be able to take all the model information built in deep learning and extend it. Given a bit more information, it might be able to tell that a new image showed a mammal or some other type of animal — and if presented the photo of a fire-hydrant could tell the human operator that this was a novel "animal" never seen before and deserving of more study. AI can go beyond narrow categories of results.

Within cybersecurity, AI is being used to help analysts sort through and classify the vast array of input data coming into the security operations center (SOC) every day. The important note is that, today, the possibility for an unexpected result means that AI is used to assist or augment human analysts rather than merely drive security automation.

Not Quite Skynet
With each of these types of machine intelligence, operators have to be aware of the possibility of two huge issues, one driven by internal forces and the other driven from external agents. The internal issue is called "model bias" — the possibility that the data used for learning in the system's model of its world will push it in a particular direction for analysis, rather than allowing the system to simply reach the mathematically correct answers.

The external problem comes through "model poisoning," in which an external agent makes sure the model will deliver inaccurate results. The poisoning can provide results that are embarrassing — or devastating, depending on the application, and the IT or security staff has to be aware of the possibility.

Related Content: