-: Machine learning.
In this lesson, we're going to talk about machine learning
and a couple of related concepts.
These are known as artificial intelligence or AI,
machine learning or ML, and deep learning.
First, let's talk about artificial intelligence.
Now, artificial intelligence is the science
of creating machines with the ability
to develop problem solving and analysis strategies
without significant human direction or intervention.
Essentially, we want to have a machine
that can think for itself.
Now, there are a lot of great things that we can do
with artificial intelligence, especially in cyber security.
When we start looking at artificial intelligence,
we can create these expert systems.
And the original ones use these if-then-else statements
to basically make things happen based on a limited dataset
using knowledge bases and set rules,
but modern AI can think for itself.
And that's really where the benefit comes.
Now, we're going to talk about this as we go through
in terms of machine learning, though,
because machine learning is a component of AI
that really enables the machines to develop strategies
for solving a given task.
Now, if you get a labeled dataset
where the features have been manually identified,
but they don't have further explicit instructions.
And so, machine learning, the concept here is,
you have to train the machine.
If you don't teach the machine what you want it to know,
it's not going to know how to categorize things.
And machine learning works really, really well
when you start dealing with things that are dealing
with labels or categorizations.
So, for example, if I wanted to go through a dataset
and say, this is malware, this is not,
this is malware, this is not, and I train the machine,
it can then take over using its behavioral engine
and machine learning to identify
on its own what is and what is not malware.
Now, this isn't a rule-based set,
but by training it with a large dataset,
it, over time, can start learning on its own.
Let me give you a real world example of this.
One of the earlier machine learning case studies they did
was training a machine to identify
what was a party and what wasn't.
And so, they started showing it images.
So, for example, if I showed the computer an image like this,
I would categorize it and say, this is a party,
there's a bunch of people there, they're having a good time,
they're playing with some confetti.
Looking at it as a human, I would say, yes, this is a party.
Then they would show it another image,
and the computer would sit there and look at it,
and say, nope, that doesn't look like a party to me,
Looks like they are at the office working.
No, that's not a party.
And the human would categorize it.
And they would keep doing this with images.
The next one here, is this a party?
No, it looks like they're at a conference.
They're at a work event.
They are smiling, which is usually a sign of a party,
but they're obviously not at a party.
And so, I would say, no, this is not a party.
Then they go to the next one.
What about this one?
There's a couple of ladies dancing.
That looks like a party, right?
They're probably having a good time either at a club
or at a friend's house, and they have a drink in their hand
and they're having a good time at a party.
So, I would say, yes, that's a party.
And then I go to another one.
Here's one where people are sitting around a table.
They're eating, they're having a good time,
and there's a lot of different people at this table.
So, it looks like they're having a dinner party.
So, I can categorize that as a party and say, yes, it is.
Now, what's the problem with what I just did?
I went through five images,
which is a very limited dataset,
but let's say I do this with 5,000 images.
That would be enough for a computer
to start making some decisions
on what's a party and what isn't.
So, what is the problem that just happened
when I use these images
to train this machine learning engine?
Well, the problem is I just trained this computer
to be racist.
That's right, because if you look back
at these images I just went through,
all the ones that were at parties,
they only had men and women and only people who are white.
The only image that had somebody who was
of a darker complexion, an African American
or a black person, happened
to be at that business conference.
So, this computer has now just learned
that for a party to exist, it has to have white people.
This is a problem with machine learning,
because if you give it a bad dataset,
you can train these machines to be racist,
to be discriminatory, or to simply misclassify things
and miss things.
So, you have to be very careful
with the datasets you provide these machines
so they can learn.
Now, this is the danger with machine learning.
Machine learning is only as good as the datasets
that are used to train it.
So, you have to keep this in mind
when you're going through and creating your datasets.
If you're trying to train it what malware looks like,
you need to make sure that you identify properly
what is malware and what isn't
as you're feeding at those datasets.
And this is the same thing we deal with images
or any other type of dataset you're feeding it.
Now, the next concept we need
to talk about is an artificial neural network or ANN.
This is an architecture of input, hidden, and output layers
that can perform algorithmic analysis of a dataset
to achieve outcome objectives.
Now, essentially, when we have an artificial neural network,
this is the pathways that are being created
based on that learning it's doing.
So, as it's learning, it's starting
to make its own feedback loops of what is the right if-then.
If I see this, I see somebody holding a glass
of champagne, that's a party.
If I see people eating food, smiling,
and having a good time, that's a party.
If I see people dancing, that's a party.
That's all part of this neural network.
And it's all being developed on the fly
by the computer based on what it's learning.
Now, a machine learning system
can adjust its neural networks over time.
And they do this to try to reduce errors
and optimize the objectives, because they're trying
to always get to better identification
of what you're trying to identify.
In my example, identifying what is and is not a party.
So, now at this point, we've already talked
about artificial intelligence.
We started talking about machine learning,
and now we're going to dive a little bit deeper
and go into deep learning.
Now, when we talk about deep learning, this is refinement
of machine learning that enables a machine
to develop strategies for solving a task,
given a labeled dataset.
Now, all of that, so far, sounds like machine learning,
but here's the difference,
without further explicit instructions.
So, I can just hand it a dataset
and it will start making its own determinations.
I don't have to do all the categorization for it.
That's the difference with deep learning.
So, when you create deep learning,
deep learning is going to use complex classes
of knowledge defined in relation to simpler classes
of knowledge, to make more informed determinations
about an environment.
So, I might start out giving it that simple dataset
and saying, this is party, this isn't a party,
but then I turn it over to the machine and it can learn
from there much better on its own what is
and is not a party based on its own observations.
Basically, it's like a child, and when it starts out,
it doesn't know much, but as it learns and grows,
it creates deeper and deeper connections
inside its neural networks to make better decisions.
So, to help solidify what the differences
between machine learning and deep learning,
let me give you an example that applies
to the cyber security world.
Let's say I have network traffic,
and I'm going to take that as my input.
And I want to be able to categorize that
and say, this is benign, or this is malicious,
this is okay, and this is something
that's bad and needs to be flagged.
Now, if I'm dealing with machine learning, I have a human
who has to determine what those malicious factors are.
Just like, I sat there and said,
this is a party, this is not a party,
I would have to sit there and start training that system.
So, you might have a week period or a month period,
or even a six-month period where you have analysts
who are actually going through and categorizing traffic
that you're seeing as malicious or benign,
and based on that,
that is going to start training the computer on what it is,
and then the computer can take over.
Now, when you deal with deep learning,
you don't even have a human there.
You just send it the network traffic, and over time,
it's going to make its own decisions on what is benign
and what is malicious, training itself.
And so, we have those deeper connections
that really starts figuring out what are those things
that make up something that's malicious.
Now, how would the computer know?
Well, maybe it's being able to see your whole network
and it sees one computer that you took offline,
re-imaging it and put it back online,
and now knows there was something bad on that system.
And based on that, it can start looking into those logs
and figure out what was it it saw
that may have been an indicator of malicious traffic.
And so, these things can learn over time.
Now, are we there yet?
Are we a 100% with deep learning and all of that
that goes with it, for it to be able to do all of this
on its own without people?
Not yet, but we are getting better and better all the time.
Now, a lot of people worry this is going to put humans
out of jobs, but I will tell you,
that's not going to be the case,
because we still need people to make decisions.
We still need people to look at those things.
All this is doing
in this deep learning scenario is labeling it.
It's saying this is bad, or this isn't bad,
but then a human is going to look at it and verify that it is
and take follow-on actions.
Now, some of the newer systems
that they're trying to build are going to try to take the human
out of the loop completely,
but that is a very dangerous thing to do,
because you're relying solely on the computer's decision,
and then it could take follow-on actions like removing
that system from the network, re-imaging the machine,
and other things.
So, you have to keep those things in mind too
when you're deciding how far you want to go
with machine learning and deep learning.