so hello my name is Helena and I will
not do many interruptions like so I do
cyber security and forensics at
Edinburgh Napier University I am
currently doing my well pop of my third
year in a financial institution during
placement I'm going to tell you they are
often no I used to be part of the any
SEC committee any second is the rival to
average a hackers over nature you should
join I also do magic tricks and I am a
TEDx organizer very happy to talk about
either of those things after the talk
the only reason that I'm doing this talk
is because I want to get more Twitter
followers than my dad and currently
about 450 people off so if you can
please follow me there that's me please
I really really need it like my I
thought about going on alright so a
short disclaimer and I will take my card
south I am woefully under qualified to
get this hope I have not done machine
learning in an academic environment ever
and I didn't think I ever level unless I
do a masters which is possible I did
machine learning for the first time as a
project network it was given to me and
this tool aims to be the talk that I
wish I had seen before I actually start
to project because I found it was a
little bit of an uphill struggle
especially at the start if you have done
machine learning at work or university
go away you're not going to learn
anything here this is very much an
introduction you might see a whole
satara sniffs but that's basically all
you're gonna learn so yeah I won't feel
offended if you do get up and leave so
[Music]
oh right yes so this is a Twitter poll I
got is anybody that voted in this
Twitter poll here like Ford
okay well I guess so this is your hope
so we're gonna do an interactive magic
trick I need a volunteer
okey what's your name meat let the
mortgagor done it doesn't matter
everybody's gonna do the trick anyways
right so what I would you to do is to
put your hands up with this in front of
you
brilliant and now I would like everybody
else in the room to do exactly the same
as chump
if anybody isn't doing it you can put
down your coat it's fine this one never
mind oh I'm sorry you're really injured
okay
if you're injured please don't do this
coking this unlike this and a line go
okay so now when I count to three what I
want you to do is to go off right but
hoping will take not to plus me
yes exactly okay so one two three
and everybody's poking each other right
and now magics gonna begin abracadabra
right so onto the boring stuff oh no no
we're good okay so what is machine
learning machine learning is a subset
keep trying I'll teach you later machine
learning is a subset of AI but those
algorithms that allow computers to learn
to perform tasks from day tens of being
explicitly programmed to do things so
the reason that I've put these things
out this because a they're pretty funny
in my opinion but also the most common
kind of trend that I've noticed in terms
of security people is a lack of
understanding about the difference
between what a if statement is or a lot
of misstatements and an actual machine
learning algorithm so um the difference
is that while if-else statements are
very good at dealing with with sorry
with data that doesn't change machine
learning is very good at acting in
stochastic or randomized environments so
it's very good at taking new data and
figuring out what to do is that even if
it hasn't seen it before so let's take
an example of a dump
great if we've got an if-else statement
that is trying to see if something is ID
or not maybe it's
to have a question about how many likes
the doll counts right
so if dog has four legs then don't but
what if the dog had a car accident and
has only three legs so the default
statement is going to fail at that point
unless it's a little bit of a smart one
none has seen this kind of dog before
and a developer has gone in and changed
to change the algorithm to a purses
cabinet but a machine learning algorithm
because of how similar this dog is to
other dolls or because of other features
of the dog like its fur or you know
velocity of zoomies and things like that
thank you for laughing it's going to be
able to classify this dog has a dog even
though it doesn't fulfill the exact
criteria of a dog that it seemed before
the slicker
so um one question that I've heard a lot
as well is what is AI what is machine
learning how many different so um you
might not see at the back so I will do
the terrible thing at breathing outsides
artificial intelligence is a program
that can sense reason act and adapt
while machine learning is an application
of AI so one thing that we need to
understand when we're talking about
machine learning it's the difference
between deep and shallow learning as
well so deep learning is a little bit
out of scope for this talk today because
we wouldn't thirty minutes and I
completely don't understand
but essentially deep learning is good at
figuring out what features to select on
its own whenever it's trying to
determine for example a classification
of a certain object while shallow
learning needs experts like security
professionals like all of us to explain
to the algorithm which features of a
certain object are going to be important
when we're going to try and determine
will anything
it's um yeah everyone is going to use a
more accurate representation of machine
learning and AI and this whole ecosystem
of trying to use applied this area of
knowledge to security this is more what
this is what it would look like but we
don't have to worry about that this is a
short talk so my friend Gordon who is
somewhere in here I hope oh hi on a
drunken night out before I had ever
touched machine learning at an any sec
social which is great he said something
along the lines of this which I will
read out for the people at the back I
don't understand unsupervised machine
learning can he just can't you just use
the supervisor that supervised a
supervised machine learning to supervise
the unsupervised machine learning the
answer to that is no but let me explain
a little bit more so it's kind of the
wrong question to ask in the first place
because supervised learning requires
training on a large labeled data set so
what you're doing is you are feeding the
machine learning algorithm data where it
will have some kind of way of verifying
at the end if it's making the right
choices or not
now the issue with supervised learning
is that you need to have a labelled data
set and these are actually pretty hard
to come by especially in computer
security there are and I will touch on
this a little later as well but the most
popular machine learning data sets for
example detecting malicious network
connections are from like 1998 that's
pretty old at the moment so we do have a
significant black of labeled dates which
is why um a more common use case well
actually I don't know the statistics
that might not be more common but a
common use case is unsupervised machine
learning which does not require labeled
HR at a higher level what an
unsupervised machine learning algorithms
do is it will look at the similarities
and similarities and dissimilarities
between different data points and it
will group them together based on that
so if it's got a red cap and a green cap
it might put them separately but if it's
got an orange cat in might get near to
the red cap because it's fairly someone
um but one thing I should probably
mention here is that supervised learning
is usually easily has two categories one
of which is classification and one of
them is regression classification is
trying to determine if something is for
example red or blue and regression is
trying to predict some kind of
continuous or a numeric variable while
unsupervised learning is going to be
devided usually up until clustering or
Association clustering being looking for
inherit groups in the data so for
example dogs cats an association being
trying to look for rule surf horizontal
people that click on X will also do what
it's really warning here
right I know this looks scary don't
worry I want to point able to this
really good cheat sheet just because if
you do ever end up doing machine
learning and you're using scikit-learn
in Python you will probably come across
this and this is brilliant especially if
you're starting out but for most of us
we're like my world from Fawlty Towers
but let me go through each little bit of
this diagram so regression the classic
example of regression you can see here
so if you've got 1,000 houses or who
says I suppose in dundee francs you can
fold them on a graph where X is the
price and Y is the highest sorry all the
way around I'm really good at completely
right but anyway so
you plot the price and the size on a
graph and you put each house that you've
got and undie that you know about on to
the graph so one is here what is there
etcetera etcetera then what you will do
is you will try to use an algorithm to
draw a line that will best represent all
of this data which means that then if
you've got a new house that is of a
certain size you can go okay well it's
there going up to this line it is
probably going to cost around plus very
cheap but like 1,300 pounds apartment
and here I will quickly go into
overfitting so one of the issues that
you will encounter if you are going to
use this kind of algorithm is that you
might overfit the data what this means
is that when you draw this line you can
make it fit the data points that you've
got so well like here that if you change
the data your line won't be
representative of the new data anymore
so for example if we put a house here if
you had a new house work that with the
size that is here on the graph you would
see that it's maybe not going to be as
representative as one that you would put
on a line that is just right and then
underfitting is the other side of the
spectrum where obviously you're not
going to have any meaningful results if
your line is just basically drawing
wherever but next bit of the lovely
python diner so we've got classification
I touched on this briefly before so I'm
going to do this fast classification is
a supervised learning approach where is
a computer learns from labelled data and
uses this to classify new observations
so it could be by class so for example
malicious not malicious but it also
could also be a number of different
classes now the why a classification
actually has loads of applications
especially in computer security not only
but here as well you know is it malware
is it phishing is it malicious
all of these things can be solved using
machine learning algorithms the problem
is finding good labelled ixelles
clustering now clusterings are really
interesting and the reasons that you do
it are actually quite cool so it's an
unsupervised learning method where what
you're going to try and do is find
meaningful structure or groupings in a
set of data again like I said before
uses the similarity and dissimilarity
between objects to put them into certain
groups now you use this on data that you
usually don't know much about this is
called explorative analysis so the
reason that this is hard is because for
most algorithms firstly you need to
determine how many groups you're going
to group it into and for that you need
to basically look at the data I boa and
have some kind of intuition or use
complicated and complex statistical
analysis to figure out how many groups
you want to create and the other issue
is that it's kind of hard to interpret
the data sometimes because humans are
very good at understanding data that is
in multiple dimensions because we can't
visualize it then we can't see it now
apart from finding groups of things you
can also use clustering for anomaly
detection so if you've got three very
clear groups like here but then you put
some little blobs that are outside of
one of the groups you can think oh well
maybe that's an anomaly which is useful
in security the last bit of the graph is
dimensionality reduction which is the
10-minutes dama pairing in a bit quick
which is which is reducing the number of
random variables in a dataset so that in
a dataset where you will have a number
of relevant features that are going to
solve your problem so for example if
you've got a email that will have
features such as the lengths of the
actual content of the email the time it
was sent and let's say this under domain
and you might think
for fishing the thing that you want to
use to classify as fishing or not would
be this under domain rather than the
time that it was sent because that could
be random not going into it in detail
dimensionality reduction is basically
trying to figure out which of the
features are less important than others
and taking them away or making them less
impactful on the machine learning model
and yeah I'm not going to be honest so
why do we need this let's look at this
from a kind of enterprise security point
of view because I assume that most
people here are going to move into that
space at some point in their life so we
have a lot of data and we have to
protect organisations from threats and
we have to detect them as well so we use
lots of for intelligence feeds
rule-based IDS's rules about file
downloads outside should to try and do
this but with a growing number of data
and excuse me of the term but the cyber
threat landscape ever opened and the
infamous skill shortage in security
we need our people to be charging Prats
that actually exists
and there is a lot of false positives in
socks thank you
socks isn't security operation centers
no socks my mom is going to watch this
one day and she'll be like more so the
vision for this is that sorry I'm going
to stay here
it's not easy there are lots of
accessible libraries and toolkits to do
machine learning in general but we still
need skilled developers to be able to
not only understand security but also
understand how to choose the different
features that we're going to use to
build our machine learning models now
machine learning security use cases are
usually divided into two different
things one is pattern recognition and
one is anomaly detection it's easy to
conflate both of them but they have
slightly different goals
so in pattern recognition we're going to
detect characteristics and data and
these characters which can be used later
to teach an algorithm to recognize forms
of data that are the same or different
from
characteristics well an anomaly
detection you're trying to baseline
normal and find a notion of normality
that statistically covers most of the
data that you have and then anything
that differs from that will be classed
as an anomaly so this is kind of the
most important bit of this hope so if
you want to learn more about machine
learning it is actually pretty
accessible even though the Massa's heart
so I started off with a this course on
plural sight sorry you have to pay for
plural tighteners also loads of really
good three ones and this machine
learning by Stanford is really good but
you have to do it in like MATLAB or R or
something isn't Python so I was like no
um but scikit-learn and Python is really
good even just reading the documentation
is really good for looking at
applications in these cases although not
necessarily for security and last but
not least machine learning is difficult
but don't get discouraged if I can do a
little bit of it you can all definitely
do a little bit I think is a really
valuable and rewarding area to get into
especially as it makes you think about
what is actually important in security
and how we can make you know the output
of security professionals useful to a
business or a country or whoever you
work for and also you can really impress
your friends and family by saying oh
yeah I do machine learning so that was
following me on Twitter once again and
thank you so much for your attention
good question so the I'm not really
allowed to talk in depth about the
projects that I did it work however the
stuff I was working on also required
domain expertise in networks and network
security so I think that if I hadn't
known that and I had a new mission
learning I would have been completely
screwed for lack of a better word um but
I think intuition about maths and just
kind of in the village he I did not set
the school I don't we did a one course
in uni but it was really well great this
is being filmed so I think like having a
bit of an aptitude for mathematics was
also really useful but apart from that I
think as with everything is just grit
and determination you know whenever
you're well maybe I'm going to lose your
job but whenever your boss is telling
you to do it you just do it yeah sorry
right yes that is a good point good for
coming I couldn't to be honest any other
questions okay oh so a big problem with
machine learning anything that you do
I'm still just as we are - so just the
five decisions that are all who makes
you have any negative implications if
you cyber security so for example unlike
in historical an assault can I have this
machine learning that box reinstated
it's giving me all my nice through
positives what about the false positive
sort of things in helping catch DCU
agent up so I'm going to answer this
question to both as well as I can
so to the gdpr thing there is a lot of
attention put into processing people's
data in general and GDP or as and I'm
not an expert by my shirt or don't you
GPR but there is a lot of attention
button to things like dates and lasting
so making sure the data is anonymous and
in terms of I don't know how to DPI
works for kind of regulatory compliance
for not responding to cyber incidents
but I mean yes see whenever you deploy
an algorithm a machine learning
algorithm that you don't really
understand on to about tenets telling
you this is true the schools you have to
be able to justify the decision that you
made and I know that in the financial
sector regulators are incredibly strict
and it probably get really screwed if
you make the wrong decision at some
point but yeah I mean I think that's the
reason that we employ experts that will
own the risk for like anything any other
questions
manual police a national excitation um
so I think it will definitely help I
don't think I'm really qualified to
answer it but we'll replace it
completely I think you know machine
learning algorithms are already being
used to navies and things like that that
doesn't mean we don't have relay systems
as well I think at the point that
they're battering more effective but
yeah we'll use them but I don't think
because of the complexity of
implementing these things in the first
place I think you know rather than there
being a bunch of people that write rules
for assault will be a bunch of people
that write machine learning I'll bring
this Chris offering this will have to be
tested as well you know the whole
problems just going to repeat itself is
just going to be more complex any other
questions oh I'm out of time today thank
you so much