1 1 00:00:00,540 --> 00:00:02,340 Machine Learning. 2 2 00:00:02,340 --> 00:00:05,010 In this lesson, we're going to talk about machine learning 3 3 00:00:05,010 --> 00:00:06,990 and a couple of related concepts. 4 4 00:00:06,990 --> 00:00:09,630 These are known as artificial intelligence or AI, 5 5 00:00:09,630 --> 00:00:13,230 machine learning or ML, and deep learning. 6 6 00:00:13,230 --> 00:00:15,990 First, let's talk about artificial intelligence. 7 7 00:00:15,990 --> 00:00:17,970 Now, artificial intelligence is the science 8 8 00:00:17,970 --> 00:00:19,710 of creating machines with the ability 9 9 00:00:19,710 --> 00:00:22,410 to develop problem solving and analysis strategies 10 10 00:00:22,410 --> 00:00:25,650 without significant human direction or intervention. 11 11 00:00:25,650 --> 00:00:27,210 Essentially, we want to have a machine 12 12 00:00:27,210 --> 00:00:28,830 that can think for itself. 13 13 00:00:28,830 --> 00:00:31,260 Now, there are a lot of great things that we can do 14 14 00:00:31,260 --> 00:00:34,860 with artificial intelligence, especially in cybersecurity. 15 15 00:00:34,860 --> 00:00:36,720 When we start looking at artificial intelligence, 16 16 00:00:36,720 --> 00:00:38,490 we can create these expert systems 17 17 00:00:38,490 --> 00:00:41,790 and the original ones use these if-then-else statements 18 18 00:00:41,790 --> 00:00:44,760 to basically make things happen based on a limited dataset 19 19 00:00:44,760 --> 00:00:47,430 using knowledge bases and set rules. 20 20 00:00:47,430 --> 00:00:50,070 But modern AI can think for itself, 21 21 00:00:50,070 --> 00:00:52,230 and that's really where the benefit comes. 22 22 00:00:52,230 --> 00:00:53,550 Now, we're going to talk about this 23 23 00:00:53,550 --> 00:00:56,550 as we go through in terms of machine learning though 24 24 00:00:56,550 --> 00:00:58,980 because machine learning is a component of AI 25 25 00:00:58,980 --> 00:01:01,170 that really enables the machines to develop strategies 26 26 00:01:01,170 --> 00:01:02,940 for solving a given task. 27 27 00:01:02,940 --> 00:01:04,830 Now, if you get a labeled data set 28 28 00:01:04,830 --> 00:01:07,200 where the features have been manually identified 29 29 00:01:07,200 --> 00:01:10,020 but they don't have further explicit instructions. 30 30 00:01:10,020 --> 00:01:11,490 And so machine learning, 31 31 00:01:11,490 --> 00:01:14,190 the concept here is you have to train the machine. 32 32 00:01:14,190 --> 00:01:16,530 If you don't teach the machine what you want it to know, 33 33 00:01:16,530 --> 00:01:19,200 it's not going to know how to categorize things. 34 34 00:01:19,200 --> 00:01:21,360 And machine learning works really really well 35 35 00:01:21,360 --> 00:01:22,980 when you start dealing with things that are dealing 36 36 00:01:22,980 --> 00:01:25,230 with labels or categorizations. 37 37 00:01:25,230 --> 00:01:28,087 So for example, if I wanted to go through a dataset and say, 38 38 00:01:28,087 --> 00:01:30,210 "This is malware, this is not, 39 39 00:01:30,210 --> 00:01:32,100 this is malware, this is not," 40 40 00:01:32,100 --> 00:01:33,390 and I train the machine. 41 41 00:01:33,390 --> 00:01:36,000 It can then take over using its behavioral engine 42 42 00:01:36,000 --> 00:01:37,830 and machine learning to identify 43 43 00:01:37,830 --> 00:01:40,770 on its own what is and what is not malware. 44 44 00:01:40,770 --> 00:01:42,450 Now, this isn't a rule-based set, 45 45 00:01:42,450 --> 00:01:44,970 but by training it with a large data set, 46 46 00:01:44,970 --> 00:01:47,520 it over time can start learning on its own. 47 47 00:01:47,520 --> 00:01:49,500 Let me give you a real world example of this. 48 48 00:01:49,500 --> 00:01:52,170 One of the earlier machine learning case studies they did 49 49 00:01:52,170 --> 00:01:53,910 was training a machine to identify 50 50 00:01:53,910 --> 00:01:55,890 what was a party and what wasn't. 51 51 00:01:55,890 --> 00:01:57,750 And so they started showing it images. 52 52 00:01:57,750 --> 00:02:00,480 So for example, if I showed the computer an image like this 53 53 00:02:00,480 --> 00:02:02,700 I would categorize and say, this is a party. 54 54 00:02:02,700 --> 00:02:03,720 There's a bunch of people there. 55 55 00:02:03,720 --> 00:02:04,950 They're having a good time. 56 56 00:02:04,950 --> 00:02:06,210 They're playing with some confetti. 57 57 00:02:06,210 --> 00:02:07,140 Looking at it as a human, 58 58 00:02:07,140 --> 00:02:09,060 I would say, "Yes, this is a party." 59 59 00:02:09,060 --> 00:02:10,260 Then they would show it another image 60 60 00:02:10,260 --> 00:02:12,127 and the human would sit there and look at it and say, 61 61 00:02:12,127 --> 00:02:14,130 "Nope, that doesn't look like a party to me. 62 62 00:02:14,130 --> 00:02:15,630 Looks like they're at the office working. 63 63 00:02:15,630 --> 00:02:17,250 No, that's not a party." 64 64 00:02:17,250 --> 00:02:18,630 And the human would categorize it 65 65 00:02:18,630 --> 00:02:20,100 and they would keep doing this with images. 66 66 00:02:20,100 --> 00:02:22,200 The next one here, is this a party? 67 67 00:02:22,200 --> 00:02:23,700 No, it looks like they're at a conference. 68 68 00:02:23,700 --> 00:02:24,960 They're at a work event. 69 69 00:02:24,960 --> 00:02:27,180 They're smiling, which is usually a sign of a party, 70 70 00:02:27,180 --> 00:02:29,040 but they're obviously not at a party. 71 71 00:02:29,040 --> 00:02:31,290 And so I would say, "No, this is not a party." 72 72 00:02:31,290 --> 00:02:32,790 Then I go to the next one. 73 73 00:02:32,790 --> 00:02:33,690 What about this one? 74 74 00:02:33,690 --> 00:02:35,400 There's a couple of ladies dancing. 75 75 00:02:35,400 --> 00:02:36,690 That looks like a party, right? 76 76 00:02:36,690 --> 00:02:38,160 They're probably having a good time 77 77 00:02:38,160 --> 00:02:39,930 either at a club or at a friend's house, 78 78 00:02:39,930 --> 00:02:41,160 and they're have a drink in their hand, 79 79 00:02:41,160 --> 00:02:42,450 and they're having a good time at a party. 80 80 00:02:42,450 --> 00:02:44,160 So I would say, "Yes, that's a party." 81 81 00:02:44,160 --> 00:02:45,240 And then I go to another one. 82 82 00:02:45,240 --> 00:02:46,920 Here's one where people are sitting around a table. 83 83 00:02:46,920 --> 00:02:48,720 They're eating. They're having a good time. 84 84 00:02:48,720 --> 00:02:50,670 And there's a lot of different people at this table. 85 85 00:02:50,670 --> 00:02:52,590 So it looks like they're having a dinner party. 86 86 00:02:52,590 --> 00:02:55,440 So I can categorize that as a party and say, "Yes, it is." 87 87 00:02:55,440 --> 00:02:57,780 Now, what's the problem with what I just did? 88 88 00:02:57,780 --> 00:03:00,690 I went through five images, which is a very limited dataset, 89 89 00:03:00,690 --> 00:03:02,550 but let's say I did this with 5,000 images, 90 90 00:03:02,550 --> 00:03:03,630 that would be enough for a computer 91 91 00:03:03,630 --> 00:03:05,130 to start making its own decisions 92 92 00:03:05,130 --> 00:03:07,020 on what's a party and what isn't. 93 93 00:03:07,020 --> 00:03:08,550 So what is the problem that just happened 94 94 00:03:08,550 --> 00:03:09,630 when I use these images 95 95 00:03:09,630 --> 00:03:11,910 to train this machine learning engine? 96 96 00:03:11,910 --> 00:03:14,220 Well, the problem is I just trained this computer 97 97 00:03:14,220 --> 00:03:15,690 to be racist. 98 98 00:03:15,690 --> 00:03:16,590 That's right. 99 99 00:03:16,590 --> 00:03:19,350 Because if you look back at these images I just went through 100 100 00:03:19,350 --> 00:03:21,330 all the ones that were at parties, 101 101 00:03:21,330 --> 00:03:24,513 they only had men and women and only people who were white. 102 102 00:03:25,350 --> 00:03:26,730 The only image that had somebody 103 103 00:03:26,730 --> 00:03:28,200 who was of a darker complexion, 104 104 00:03:28,200 --> 00:03:30,210 an African American or a Black person, 105 105 00:03:30,210 --> 00:03:32,250 happened to be at that business conference. 106 106 00:03:32,250 --> 00:03:34,980 So this computer has now just learned 107 107 00:03:34,980 --> 00:03:38,220 that for a party to exist, it has to have white people. 108 108 00:03:38,220 --> 00:03:39,900 This is a problem with machine learning, 109 109 00:03:39,900 --> 00:03:42,390 because if you give it a bad dataset, 110 110 00:03:42,390 --> 00:03:44,880 you can train these machines to be racist, 111 111 00:03:44,880 --> 00:03:46,110 to be discriminatory, 112 112 00:03:46,110 --> 00:03:48,990 or to simply misclassify things and miss things. 113 113 00:03:48,990 --> 00:03:50,220 So you have to be very careful 114 114 00:03:50,220 --> 00:03:52,110 with the dataset you provide these machines 115 115 00:03:52,110 --> 00:03:53,160 so that they can learn. 116 116 00:03:53,160 --> 00:03:55,620 Now, this is the danger with machine learning. 117 117 00:03:55,620 --> 00:03:57,180 Machine learning is only as good 118 118 00:03:57,180 --> 00:03:58,980 as the data sets that are used to train it. 119 119 00:03:58,980 --> 00:04:00,600 So you have to keep this in mind 120 120 00:04:00,600 --> 00:04:02,250 when you're going through and creating your data sets. 121 121 00:04:02,250 --> 00:04:04,290 If you're trying to train it what malware looks like, 122 122 00:04:04,290 --> 00:04:06,360 you need to make sure that you identify properly 123 123 00:04:06,360 --> 00:04:07,620 what is malware and what isn't 124 124 00:04:07,620 --> 00:04:09,390 as you're feeding it those data sets. 125 125 00:04:09,390 --> 00:04:11,310 And this is the same thing we deal with images 126 126 00:04:11,310 --> 00:04:14,100 or any other type of dataset you're feeding it. 127 127 00:04:14,100 --> 00:04:15,600 Now, the next concept we need to talk about 128 128 00:04:15,600 --> 00:04:18,960 is an artificial neural network or ANN. 129 129 00:04:18,960 --> 00:04:22,230 This is an architecture of input, hidden, and output layers 130 130 00:04:22,230 --> 00:04:25,080 that can perform algorithmic analysis of a dataset 131 131 00:04:25,080 --> 00:04:27,210 to achieve outcome objectives. 132 132 00:04:27,210 --> 00:04:29,700 Now, essentially when we have an artificial neural network, 133 133 00:04:29,700 --> 00:04:32,160 this is the pathways that are being created 134 134 00:04:32,160 --> 00:04:33,990 based on that learning it's doing. 135 135 00:04:33,990 --> 00:04:34,890 So as it's learning, 136 136 00:04:34,890 --> 00:04:36,810 it's starting to make its own feedback loops 137 137 00:04:36,810 --> 00:04:38,820 of what is the right if-thens. 138 138 00:04:38,820 --> 00:04:40,170 If I see this, 139 139 00:04:40,170 --> 00:04:43,560 I see somebody holding a glass of champagne, that's a party. 140 140 00:04:43,560 --> 00:04:45,240 If I see people eating food, smiling, 141 141 00:04:45,240 --> 00:04:47,130 and having a good time, that's a party. 142 142 00:04:47,130 --> 00:04:49,470 If I see people dancing, that's a party. 143 143 00:04:49,470 --> 00:04:51,150 That's all part of this neural network, 144 144 00:04:51,150 --> 00:04:52,920 and it's all being developed on the fly 145 145 00:04:52,920 --> 00:04:55,290 by the computer based on what it's learning. 146 146 00:04:55,290 --> 00:04:57,390 Now, a machine learning system can adjust 147 147 00:04:57,390 --> 00:04:58,920 its neural networks over time, 148 148 00:04:58,920 --> 00:05:00,750 and they do this to try to reduce errors 149 149 00:05:00,750 --> 00:05:02,100 and optimize the objectives 150 150 00:05:02,100 --> 00:05:03,660 because they're trying to always get 151 151 00:05:03,660 --> 00:05:06,240 to better identification of what you're trying to identify. 152 152 00:05:06,240 --> 00:05:09,870 In my example, identifying what is and is not a party. 153 153 00:05:09,870 --> 00:05:11,040 So now at this point, 154 154 00:05:11,040 --> 00:05:12,900 we've already talked about artificial intelligence. 155 155 00:05:12,900 --> 00:05:14,850 We started talking about machine learning. 156 156 00:05:14,850 --> 00:05:16,590 And now, we're going to dive a little bit deeper 157 157 00:05:16,590 --> 00:05:18,840 and go into deep learning. 158 158 00:05:18,840 --> 00:05:20,550 Now, when we talk about deep learning, 159 159 00:05:20,550 --> 00:05:22,590 this is a refinement of machine learning 160 160 00:05:22,590 --> 00:05:24,420 that enables a machine to develop strategies 161 161 00:05:24,420 --> 00:05:27,030 for solving a task given a labeled data set. 162 162 00:05:27,030 --> 00:05:30,000 Now, all of that so far sounds like machine learning, 163 163 00:05:30,000 --> 00:05:31,380 but here's the difference, 164 164 00:05:31,380 --> 00:05:34,050 without further explicit instructions. 165 165 00:05:34,050 --> 00:05:36,360 So I can just hand it a dataset 166 166 00:05:36,360 --> 00:05:38,910 and it will start making its own determinations. 167 167 00:05:38,910 --> 00:05:41,430 I don't have to do all the categorization for it. 168 168 00:05:41,430 --> 00:05:43,200 That's the difference with deep learning. 169 169 00:05:43,200 --> 00:05:45,090 So when you create deep learning, 170 170 00:05:45,090 --> 00:05:47,730 deep learning is going to use complex classes of knowledge 171 171 00:05:47,730 --> 00:05:50,340 defined in relation to simpler classes of knowledge 172 172 00:05:50,340 --> 00:05:53,520 to make more informed determinations about an environment. 173 173 00:05:53,520 --> 00:05:56,130 So I might start out giving it that simple dataset 174 174 00:05:56,130 --> 00:05:58,770 and saying, "This is a party. This isn't a party." 175 175 00:05:58,770 --> 00:06:00,270 But then I turn it over to the machine, 176 176 00:06:00,270 --> 00:06:03,000 and it can learn from there much better on its own 177 177 00:06:03,000 --> 00:06:06,390 what is and is not a party based on its own observations. 178 178 00:06:06,390 --> 00:06:08,550 Basically, it's like a child, and when it starts out, 179 179 00:06:08,550 --> 00:06:09,420 it doesn't know much, 180 180 00:06:09,420 --> 00:06:10,980 but as it learns and grows, 181 181 00:06:10,980 --> 00:06:12,900 it creates deeper and deeper connections 182 182 00:06:12,900 --> 00:06:15,840 inside its neural networks to make better decisions. 183 183 00:06:15,840 --> 00:06:17,850 So to help solidify what the difference is 184 184 00:06:17,850 --> 00:06:19,920 between machine learning and deep learning, 185 185 00:06:19,920 --> 00:06:21,570 let me give you an example that applies 186 186 00:06:21,570 --> 00:06:23,130 to the cybersecurity world. 187 187 00:06:23,130 --> 00:06:24,870 Let's say I have network traffic 188 188 00:06:24,870 --> 00:06:26,370 and I'm going to take that as my input, 189 189 00:06:26,370 --> 00:06:27,990 and I want to be able to categorize that 190 190 00:06:27,990 --> 00:06:30,660 and say, "This is benign, or this is malicious. 191 191 00:06:30,660 --> 00:06:32,730 This is okay and this is something that's bad 192 192 00:06:32,730 --> 00:06:33,840 and needs to be flagged." 193 193 00:06:33,840 --> 00:06:35,460 Now, if I'm dealing with machine learning, 194 194 00:06:35,460 --> 00:06:36,930 I have a human who has to determine 195 195 00:06:36,930 --> 00:06:38,670 what those malicious factors are. 196 196 00:06:38,670 --> 00:06:39,817 Just like I sat there and said, 197 197 00:06:39,817 --> 00:06:42,240 "This is a party. This is not a party." 198 198 00:06:42,240 --> 00:06:44,430 I would have to sit there and start training that system. 199 199 00:06:44,430 --> 00:06:46,950 So you might have a week period or a month period 200 200 00:06:46,950 --> 00:06:49,020 or even a six-month period where you have analysts 201 201 00:06:49,020 --> 00:06:51,180 who are actually going through and categorizing traffic 202 202 00:06:51,180 --> 00:06:53,700 that you're seeing as malicious or benign. 203 203 00:06:53,700 --> 00:06:56,580 And based on that, that is going to start training the computer 204 204 00:06:56,580 --> 00:06:59,490 on what it is, and then the computer can take over. 205 205 00:06:59,490 --> 00:07:01,200 Now, when you deal with deep learning, 206 206 00:07:01,200 --> 00:07:02,430 you don't even have a human there. 207 207 00:07:02,430 --> 00:07:03,930 You just send it the network traffic. 208 208 00:07:03,930 --> 00:07:06,300 And over time, it's going to make its own decisions 209 209 00:07:06,300 --> 00:07:09,810 on what is benign and what is malicious, training itself. 210 210 00:07:09,810 --> 00:07:11,400 And so we have those deeper connections 211 211 00:07:11,400 --> 00:07:13,920 that really starts figuring out what are those things 212 212 00:07:13,920 --> 00:07:15,990 that make up something that's malicious. 213 213 00:07:15,990 --> 00:07:17,460 Now, how would the computer know? 214 214 00:07:17,460 --> 00:07:19,890 Well, maybe it's being able to see your whole network 215 215 00:07:19,890 --> 00:07:22,740 and it sees one computer that you took offline, re-imaged, 216 216 00:07:22,740 --> 00:07:24,120 and put it back online. 217 217 00:07:24,120 --> 00:07:26,310 It now knows there was something bad on that system. 218 218 00:07:26,310 --> 00:07:27,780 And based on that, it can start looking 219 219 00:07:27,780 --> 00:07:30,150 into those logs and figure out what was it it saw 220 220 00:07:30,150 --> 00:07:32,520 that may have been an indicator of malicious traffic. 221 221 00:07:32,520 --> 00:07:34,680 And so these things can learn over time. 222 222 00:07:34,680 --> 00:07:36,360 Now, are we there yet? 223 223 00:07:36,360 --> 00:07:38,250 Are we a hundred percent with deep learning 224 224 00:07:38,250 --> 00:07:40,500 and all of that that goes with it for it to be able to do 225 225 00:07:40,500 --> 00:07:42,330 all of this on its own without people? 226 226 00:07:42,330 --> 00:07:45,930 Not yet, but we are getting better and better all the time. 227 227 00:07:45,930 --> 00:07:46,860 Now, a lot of people worry 228 228 00:07:46,860 --> 00:07:48,810 this is going to put humans out of jobs 229 229 00:07:48,810 --> 00:07:50,970 but I will tell you that's not going to be the case 230 230 00:07:50,970 --> 00:07:53,220 because we still need people to make decisions. 231 231 00:07:53,220 --> 00:07:55,590 We still need people to look at those things. 232 232 00:07:55,590 --> 00:07:57,630 All this is doing in this deep learning scenario 233 233 00:07:57,630 --> 00:07:58,680 is labeling it. 234 234 00:07:58,680 --> 00:08:01,380 It's saying, "This is bad, or this isn't bad." 235 235 00:08:01,380 --> 00:08:02,730 But then a human's going to look at it 236 236 00:08:02,730 --> 00:08:05,430 and verify that it is and take follow on actions. 237 237 00:08:05,430 --> 00:08:07,830 Now, some of the newer systems that they're trying to build 238 238 00:08:07,830 --> 00:08:10,260 are going to try to take the human out of the loop completely 239 239 00:08:10,260 --> 00:08:12,300 but that is a very dangerous thing to do 240 240 00:08:12,300 --> 00:08:14,880 because you're relying solely on the computer's decision. 241 241 00:08:14,880 --> 00:08:16,230 And then it could take follow on actions 242 242 00:08:16,230 --> 00:08:18,300 like removing that system from the network 243 243 00:08:18,300 --> 00:08:20,190 re-imaging the machine and other things. 244 244 00:08:20,190 --> 00:08:21,960 So you have to keep those things in mind too 245 245 00:08:21,960 --> 00:08:23,820 when you're deciding how far you want to go 246 246 00:08:23,820 --> 00:08:25,820 with machine learning and deep learning.