Is Deep Learning actually useful for Cybersecurity threat detection in real-time?

All answers to this question.

Deep Learning is revolutionary for anomaly detection because it doesn't look for a specific "signature"; it looks for behavior that deviates from the "normal" baseline of your network. However, for a mid-sized company, the "False Positive" problem is real. If you don't have a clean dataset to train the model on, it will flag every software update as a hack. My advice is to use a "Pre-trained" security model from a vendor rather than building your own. These models have already seen millions of attacks and are much better at distinguishing between a weird user behavior and an actual lateral movement by an attacker.

   Answered 2024-04-18 by Barbara Taylor

If we use a vendor's pre-trained model, aren't we just moving back to a "Signature-based" system where we are only protected against things the vendor has already seen?

   Answered 2024-05-10 by Charles Evans

• Charles, it’s actually the opposite. These models are trained on "features" of attacks—like how a specific type of malware encrypts files—rather than the specific file name or IP address. This allows the model to catch a brand new virus (Zero-Day) because it "looks and acts" like a malicious process even if it has never been seen before. It’s more like "Intuition" for a computer. You still need a human to investigate the alerts, but the DL model catches the subtle patterns that a human analyst would miss in a sea of millions of logs.

     Commented 2024-05-20 by Matthew King

We integrated DL into our email gateway. It has been amazing at catching "Spear Phishing" attempts that don't contain any bad links but use psychological manipulation to trick employees.

   Answered 2024-06-15 by Nancy White

• That’s a great application, Nancy. Language-based threats are where Deep Learning really shines because it can understand the context of the conversation, unlike old keyword filters.

     Commented 2024-06-18 by Steven Miller