Instructor: Machine Learning. 2 2
In this lesson, we're going to talk about machine learning 3 3
and a couple of related concepts. 4 4
These are known as artificial intelligence or AI, 5 5
machine learning or ML, and deep learning. 6 6
First, let's talk about artificial intelligence. 7 7
Now, artificial intelligence is the science 8 8
of creating machines with the ability 9 9
to develop problem solving and analysis strategies 10 10
without significant human direction or intervention. 11 11
Essentially, we want to have a machine 12 12
that can think for itself. 13 13
Now, there are a lot of great things that we can do 14 14
with artificial intelligence, especially in cybersecurity. 15 15
When we start looking at artificial intelligence, 16 16
we can create these expert systems 17 17
and the original ones use these if-then-else statements 18 18
to basically make things happen based on a limited dataset 19 19
using knowledge bases and set rules. 20 20
But modern AI can think for itself, 21 21
and that's really where the benefit comes. 22 22
Now, we're going to talk about this 23 23
as we go through in terms of machine learning though 24 24
because machine learning is a component of AI 25 25
that really enables the machines to develop strategies 26 26
for solving a given task. 27 27
Now, if you get a labeled data set 28 28
where the features have been manually identified 29 29
but they don't have further explicit instructions. 30 30
And so machine learning, 31 31
the concept here is you have to train the machine. 32 32
If you don't teach the machine what you want it to know, 33 33
it's not going to know how to categorize things. 34 34
And machine learning works really really well 35 35
when you start dealing with things that are dealing 36 36
with labels or categorizations. 37 37
So for example, if I wanted to go through a dataset and say, 38 38
"This is malware, this is not, 39 39
this is malware, this is not," 40 40
and I train the machine. 41 41
It can then take over using its behavioral engine 42 42
and machine learning to identify 43 43
on its own what is and what is not malware. 44 44
Now, this isn't a rule-based set, 45 45
but by training it with a large data set, 46 46
it over time can start learning on its own. 47 47
Let me give you a real world example of this. 48 48
One of the earlier machine learning case studies they did 49 49
was training a machine to identify 50 50
what was a party and what wasn't. 51 51
And so they started showing it images. 52 52
So for example, if I showed the computer an image like this 53 53
I would categorize and say, this is a party. 54 54
There's a bunch of people there. 55 55
They're having a good time. 56 56
They're playing with some confetti. 57 57
Looking at it as a human, 58 58
I would say, "Yes, this is a party." 59 59
Then they would show it another image 60 60
and the human would sit there and look at it and say, 61 61
"Nope, that doesn't look like a party to me. 62 62
Looks like they're at the office working. 63 63
No, that's not a party." 64 64
And the human would categorize it 65 65
and they would keep doing this with images. 66 66
The next one here, is this a party? 67 67
No, it looks like they're at a conference. 68 68
They're at a work event. 69 69
They're smiling, which is usually a sign of a party, 70 70
but they're obviously not at a party. 71 71
And so I would say, "No, this is not a party." 72 72
Then I go to the next one. 73 73
What about this one? 74 74
There's a couple of ladies dancing. 75 75
That looks like a party, right? 76 76
They're probably having a good time 77 77
either at a club or at a friend's house, 78 78
and they're have a drink in their hand, 79 79
and they're having a good time at a party. 80 80
So I would say, "Yes, that's a party." 81 81
And then I go to another one. 82 82
Here's one where people are sitting around a table. 83 83
They're eating. They're having a good time. 84 84
And there's a lot of different people at this table. 85 85
So it looks like they're having a dinner party. 86 86
So I can categorize that as a party and say, "Yes, it is." 87 87
Now, what's the problem with what I just did? 88 88
I went through five images, which is a very limited dataset, 89 89
but let's say I did this with 5,000 images, 90 90
that would be enough for a computer 91 91
to start making its own decisions 92 92
on what's a party and what isn't. 93 93
So what is the problem that just happened 94 94
when I use these images 95 95
to train this machine learning engine? 96 96
Well, the problem is I just trained this computer 97 97
to be racist. 98 98
That's right. 99 99
Because if you look back at these images I just went through 100 100
all the ones that were at parties, 101 101
they only had men and women and only people who were white. 102 102
The only image that had somebody 103 103
who was of a darker complexion, 104 104
an African American or a Black person, 105 105
happened to be at that business conference. 106 106
So this computer has now just learned 107 107
that for a party to exist, it has to have white people. 108 108
This is a problem with machine learning, 109 109
because if you give it a bad dataset, 110 110
you can train these machines to be racist, 111 111
to be discriminatory, 112 112
or to simply misclassify things and miss things. 113 113
So you have to be very careful 114 114
with the dataset you provide these machines 115 115
so that they can learn. 116 116
Now, this is the danger with machine learning. 117 117
Machine learning is only as good 118 118
as the data sets that are used to train it. 119 119
So you have to keep this in mind 120 120
when you're going through and creating your data sets. 121 121
If you're trying to train it what malware looks like, 122 122
you need to make sure that you identify properly 123 123
what is malware and what isn't 124 124
as you're feeding it those data sets. 125 125
And this is the same thing we deal with images 126 126
or any other type of dataset you're feeding it. 127 127
Now, the next concept we need to talk about 128 128
is an artificial neural network or ANN. 129 129
This is an architecture of input, hidden, and output layers 130 130
that can perform algorithmic analysis of a dataset 131 131
to achieve outcome objectives. 132 132
Now, essentially when we have an artificial neural network, 133 133
this is the pathways that are being created 134 134
based on that learning it's doing. 135 135
So as it's learning, 136 136
it's starting to make its own feedback loops 137 137
of what is the right if-thens. 138 138
If I see this, 139 139
I see somebody holding a glass of champagne, that's a party. 140 140
If I see people eating food, smiling, 141 141
and having a good time, that's a party. 142 142
If I see people dancing, that's a party. 143 143
That's all part of this neural network, 144 144
and it's all being developed on the fly 145 145
by the computer based on what it's learning. 146 146
Now, a machine learning system can adjust 147 147
its neural networks over time, 148 148
and they do this to try to reduce errors 149 149
and optimize the objectives 150 150
because they're trying to always get 151 151
to better identification of what you're trying to identify. 152 152
In my example, identifying what is and is not a party. 153 153
So now at this point, 154 154
we've already talked about artificial intelligence. 155 155
We started talking about machine learning. 156 156
And now, we're going to dive a little bit deeper 157 157
and go into deep learning. 158 158
Now, when we talk about deep learning, 159 159
this is a refinement of machine learning 160 160
that enables a machine to develop strategies 161 161
for solving a task given a labeled data set. 162 162
Now, all of that so far sounds like machine learning, 163 163
but here's the difference, 164 164
without further explicit instructions. 165 165
So I can just hand it a dataset 166 166
and it will start making its own determinations. 167 167
I don't have to do all the categorization for it. 168 168
That's the difference with deep learning. 169 169
So when you create deep learning, 170 170
deep learning is going to use complex classes of knowledge 171 171
defined in relation to simpler classes of knowledge 172 172
to make more informed determinations about an environment. 173 173
So I might start out giving it that simple dataset 174 174
and saying, "This is a party. This isn't a party." 175 175
But then I turn it over to the machine, 176 176
and it can learn from there much better on its own 177 177
what is and is not a party based on its own observations. 178 178
Basically, it's like a child, and when it starts out, 179 179
it doesn't know much, 180 180
but as it learns and grows, 181 181
it creates deeper and deeper connections 182 182
inside its neural networks to make better decisions. 183 183
So to help solidify what the difference is 184 184
between machine learning and deep learning, 185 185
let me give you an example that applies 186 186
to the cybersecurity world. 187 187
Let's say I have network traffic 188 188
and I'm going to take that as my input, 189 189
and I want to be able to categorize that 190 190
and say, "This is benign, or this is malicious. 191 191
This is okay and this is something that's bad 192 192
and needs to be flagged." 193 193
Now, if I'm dealing with machine learning, 194 194
I have a human who has to determine 195 195
what those malicious factors are. 196 196
Just like I sat there and said, 197 197
"This is a party. This is not a party." 198 198
I would have to sit there and start training that system. 199 199
So you might have a week period or a month period 200 200
or even a six-month period where you have analysts 201 201
who are actually going through and categorizing traffic 202 202
that you're seeing as malicious or benign. 203 203
And based on that, that is going to start training the computer 204 204
on what it is, and then the computer can take over. 205 205
Now, when you deal with deep learning, 206 206
you don't even have a human there. 207 207
You just send it the network traffic. 208 208
And over time, it's going to make its own decisions 209 209
on what is benign and what is malicious, training itself. 210 210
And so we have those deeper connections 211 211
that really starts figuring out what are those things 212 212
that make up something that's malicious. 213 213
Now, how would the computer know? 214 214
Well, maybe it's being able to see your whole network 215 215
and it sees one computer that you took offline, re-imaged, 216 216
and put it back online. 217 217
It now knows there was something bad on that system. 218 218
And based on that, it can start looking 219 219
into those logs and figure out what was it it saw 220 220
that may have been an indicator of malicious traffic. 221 221
And so these things can learn over time. 222 222
Now, are we there yet? 223 223
Are we a hundred percent with deep learning 224 224
and all of that that goes with it for it to be able to do 225 225
all of this on its own without people? 226 226
Not yet, but we are getting better and better all the time. 227 227
Now, a lot of people worry 228 228
this is going to put humans out of jobs 229 229
but I will tell you that's not going to be the case 230 230
because we still need people to make decisions. 231 231
We still need people to look at those things. 232 232
All this is doing in this deep learning scenario 233 233
is labeling it. 234 234
It's saying, "This is bad, or this isn't bad." 235 235
But then a human's going to look at it 236 236
and verify that it is and take follow on actions. 237 237
Now, some of the newer systems that they're trying to build 238 238
are going to try to take the human out of the loop completely 239 239
but that is a very dangerous thing to do 240 240
because you're relying solely on the computer's decision. 241 241
And then it could take follow on actions 242 242
like removing that system from the network 243 243
re-imaging the machine and other things. 244 244
So you have to keep those things in mind too 245 245
when you're deciding how far you want to go 246 246
with machine learning and deep learning.