TechCentralTechCentral
    Facebook Twitter YouTube LinkedIn
    Facebook Twitter LinkedIn YouTube
    TechCentralTechCentral
    NEWSLETTER
    • News

      Google’s giant Equiano Internet cable has landed in South Africa

      8 August 2022

      The African tech start-ups eyeing global markets

      8 August 2022

      Karpowership loses bid to overturn environmental ruling

      8 August 2022

      New app launched to tackle potholes in South Africa

      8 August 2022

      Rogue database felled Capitec in its worst-ever IT outage

      7 August 2022
    • World

      Nvidia issues profit warning on slump in demand for graphics cards

      8 August 2022

      Buterin: Mining on Ethereum Classic won’t affect Merge

      8 August 2022

      Musk challenges Twitter CEO to a public debate

      7 August 2022

      Amazon splashes $1.7-billion on Roomba maker iRobot

      5 August 2022

      Nigeria asks Google to block banned groups from YouTube

      5 August 2022
    • In-depth

      The length of Earth’s days has been increasing – and no one knows why

      7 August 2022

      As Facebook fades, the Mad Men of advertising stage a comeback

      2 August 2022

      Crypto breaks the rules. That’s the point

      27 July 2022

      E-mail scams are getting chillingly personal

      17 July 2022

      Webb telescope’s stunning images of the cosmos

      12 July 2022
    • Podcasts

      How South Africa can woo more women into tech

      4 August 2022

      Book and check-in via WhatsApp? FlySafair is on it

      28 July 2022

      Interview: Why Dell’s next-gen PowerEdge servers change the game

      28 July 2022

      Demystifying the complexity of AI – fact vs fiction

      6 July 2022

      How your organisation can triage its information security risk

      22 June 2022
    • Opinion

      SIU seeks to set aside R215-million IT tender

      19 July 2022

      No reason South Africa should have a shortage of electricity: Ramaphosa

      11 July 2022

      Ntshavheni’s bias against the private sector

      8 July 2022

      South Africa can no longer rely on Eskom alone

      4 July 2022

      Has South Africa’s advertising industry lost its way?

      21 June 2022
    • Company Hubs
      • 1-grid
      • Altron Document Solutions
      • Amplitude
      • Atvance Intellect
      • Axiz
      • BOATech
      • CallMiner
      • Digital Generation
      • E4
      • ESET
      • Euphoria Telecom
      • IBM
      • Kyocera Document Solutions
      • Microsoft
      • Nutanix
      • One Trust
      • Pinnacle
      • Skybox Security
      • SkyWire
      • Tarsus on Demand
      • Videri Digital
      • Zendesk
    • Sections
      • Banking
      • Broadcasting and Media
      • Cloud computing
      • Consumer electronics
      • Cryptocurrencies
      • Education and skills
      • Energy
      • Fintech
      • Information security
      • Internet and connectivity
      • Internet of Things
      • Investment
      • IT services
      • Motoring and transport
      • Public sector
      • Science
      • Social media
      • Talent and leadership
      • Telecoms
    • Advertise
    TechCentralTechCentral
    Home»Sections»Information security»How Microsoft, Google use AI to fight hackers

    How Microsoft, Google use AI to fight hackers

    Information security By Agency Staff4 January 2019
    Facebook Twitter LinkedIn WhatsApp Telegram Email

    Last year, Microsoft’s Azure security team detected suspicious activity in the cloud computing usage of a large retailer: one of the company’s administrators, who usually logs on from New York, was trying to gain entry from Romania. And no, the admin wasn’t on holiday. A hacker had broken in.

    Microsoft quickly alerted its customer, and the attack was foiled before the intruder got too far.

    Chalk one up to a new generation of artificially intelligent software that adapts to hackers’ constantly evolving tactics. Microsoft, Google, Amazon.com and various start-ups are moving away from solely using older “rules-based” technology designed to respond to specific kinds of intrusion and deploying machine-learning algorithms that crunch massive amounts of data on logins, behaviour and previous attacks to ferret out and stop hackers.

    Security is an arms race, and the security of machine-learning and pattern-recognition systems is not an exception

    “Machine learning is a very powerful technique for security — it’s dynamic, while rules-based systems are very rigid,” says Dawn Song, a professor at the University of California at Berkeley’s Artificial Intelligence Research Lab. “It’s a very manual intensive process to change them, whereas machine learning is automated, dynamic and you can retrain it easily.”

    Hackers are themselves famously adaptable, of course, so they, too, could harness machine learning to create fresh mischief and overwhelm the new defences. For example, they could figure out how companies train their systems and use the data to evade or corrupt the algorithms. The big cloud services companies are painfully aware that the foe is a moving target but argue that the new technology will help tilt the balance in favour of the good guys.

    “We will see an improved ability to identify threats earlier in the attack cycle and thereby reduce the total amount of damage and more quickly restore systems to a desirable state,” says Amazon chief information security officer Stephen Schmidt. He acknowledges that it’s impossible to stop all intrusions but says his industry will “get incrementally better at protecting systems and make it incrementally harder for attackers”.

    Blunter instruments

    Before machine learning, security teams used blunter instruments. For example, if someone based at headquarters tried to log in from an unfamiliar locale, they were barred entry. Or spam e-mails featuring various misspellings of the word “Viagra” were blocked. Such systems often work.

    But they also flag lots of legitimate users — as anyone prevented from using their credit card while abroad knows. A Microsoft system designed to protect customers from fake logins had a 2.8% rate of false positives, according to Azure chief technology officer Mark Russinovich. That might not sound like much but was deemed unacceptable since Microsoft’s larger customers can generate billions of logins.

    To do a better job of figuring out who is legit and who isn’t, Microsoft technology learns from the data of each company using it, customising security to that client’s typical online behaviour and history. Since rolling out the service, the company has managed to bring down the false positive rate to .001%. This is the system that outed the intruder in Romania.

    Training these security algorithms falls to people like Ram Shankar Siva Kumar, a Microsoft manager who goes by the title of Data Cowboy. Siva Kumar joined Microsoft six years ago from Carnegie Mellon after accepting a second-round interview because his sister was a fan of Grey’s Anatomy, the medical drama set in Seattle. He manages a team of about 18 engineers who develop the machine-learning algorithms and then make sure they’re smart and fast enough to thwart hackers and work seamlessly with the software systems of companies paying big bucks for Microsoft cloud services.

    Siva Kumar is one of the people who gets the call when the algorithms detect an attack. He has been woken in the middle of the night, only to discover that Microsoft’s in-house “red team” of hackers were responsible. (They bought him cake to compensate for lost sleep.)

    Google now checks for security breaches even after a user has logged in, which comes in handy to nab hackers who initially look like real users

    The challenge is daunting. Millions of people log into Google’s Gmail each day alone. “The amount of data we need to look at to make sure whether this is you or an impostor keeps growing at a rate that is too large for humans to write rules one by one,” says Mark Risher, a product MD who helps prevent attacks on Google’s customers.

    Google now checks for security breaches even after a user has logged in, which comes in handy to nab hackers who initially look like real users. With machine learning able to analyse many different pieces of data, catching unauthorised logins is no longer a matter of a single yes or no. Rather, Google monitors various aspects of behaviour throughout a user’s session. Someone who looks legit initially may later exhibit signs they are not who they say they are, letting Google’s software boot them out with enough time to prevent further damage.

    Besides using machine learning to secure their own networks and cloud services, Amazon and Microsoft are providing the technology to customers. Amazon’s Macie service uses machine learning to find sensitive data amid corporate info from customers like Netflix and then watches who is accessing it and when, alerting the company to suspicious activity. Amazon’s GuardDuty monitors customers’ systems for malicious or unauthorised activity. Many times the service discovers employees doing things they shouldn’t — such as mining bitcoin at work.

    CxO spamming

    Dutch insurance company NN Group uses Microsoft’s Advanced Threat Protection to manage access to its 27 000 workers and close partners, while keeping everyone else out. Earlier this year, Wilco Jansen, the company’s manager of workplace services, showed employees a new feature in Microsoft’s Office cloud software that blocks so-called CxO spamming, whereby spammers pose as a senior executive and instruct the receiver to transfer funds or share personal information.

    Ninety minutes after the demonstration, the security operations centre called to report that someone had tried that exact attack on NN Group’s CEO. “We were like ‘oh, this feature could already have prevented this from happening’,” Jansen says. “We need to be on constant alert, and these tools help us see things that we cannot manually follow.”

    Machine-learning security systems don’t work in all instances, particularly when there is insufficient data to train them. And researchers and companies worry constantly that they can be exploited by hackers.

    For example, they could mimic users’ activity to foil algorithms that screen for typical behaviour. Or hackers could tamper with the data used to train the algorithms and warp it for their own ends — so-called poisoning. That’s why it’s so important for companies to keep their algorithmic criteria secret and change the formulas regularly, says Battista Biggio, a professor at the University of Cagliari’s Pattern Recognition and Applications Lab in Sardinia, Italy.

    So far, these threats feature more in research papers than real life. But that’s likely to change As Biggio wrote in a paper last year: “Security is an arms race, and the security of machine-learning and pattern-recognition systems is not an exception.”  — Reported by Dina Bass, (c) 2018 Bloomberg LP

    Amazon Google Microsoft top
    Share. Facebook Twitter LinkedIn WhatsApp Telegram Email
    Previous ArticleApple has priced itself out of the market
    Next Article Intel AI to fight poaching in Africa

    Related Posts

    Google’s giant Equiano Internet cable has landed in South Africa

    8 August 2022

    The African tech start-ups eyeing global markets

    8 August 2022

    Nvidia issues profit warning on slump in demand for graphics cards

    8 August 2022
    Add A Comment

    Comments are closed.

    Promoted

    You don’t need a call centre to take advantage of call centre technology

    5 August 2022

    Black man, you are still on your own

    5 August 2022

    UC&C interoperability offers businesses operational cost relief in tough times

    4 August 2022
    Opinion

    SIU seeks to set aside R215-million IT tender

    19 July 2022

    No reason South Africa should have a shortage of electricity: Ramaphosa

    11 July 2022

    Ntshavheni’s bias against the private sector

    8 July 2022

    Subscribe to Updates

    Get the best South African technology news and analysis delivered to your e-mail inbox every morning.

    © 2009 - 2022 NewsCentral Media

    Type above and press Enter to search. Press Esc to cancel.