A modern solution for a modern problem: IBM tackles cyber security
IBM is tackling modern security issues with a modern approach: cognitive technology. As part of a year long research project, IBM is rolling out Watson for Cyber Security, a new cloud-based version of the company's cognitive tech that focuses on the language of security.
IBM Watson is the organisation's technology platform that uses natural language processing and machine learning to reveal insights from large amounts of unstructured data.
According to a statement, IBM is teaming up with eight universities around the United States to further scale the system and expand the collection of security data that Watson is currently trained with.
According to IBM, training for Watson for Cyber Security is a crucial step in the advancement of cognitive security. At present, Watson is learning the nuances of security research findings and discovering patterns and evidence of hidden cyber attacks and threats that could otherwise be missed. Using cognitive systems that automate the connections between data, emerging threats and remediation strategies further enables security analysts and helps to address the cyber security skills gap.
In order to expand Watson's understanding of cyber security, IBM is working with a range of universities and their students, including: California State Polytechnic University, Pomona; Pennsylvania State University; Massachusetts Institute of Technology; New York University; the University of Maryland, Baltimore County (UMBC); the University of New Brunswick; the University of Ottawa and the University of Waterloo.
IBM's X-Force research library will also be a central part of the materials fed to Watson for Cyber Security. This body of knowledge includes 20 years of security research, details on eight million spam and phishing attacks and more than 100,000 documented vulnerabilities.
Understanding and addressing the security skills gap
The volume of security data presented to analysts is vast, according to IBM. For instance, the average organisation sees more than 200,000 pieces of security event data per day, with enterprises spending $1.3 million a year dealing with false positives alone, wasting nearly 21,000 hours.
On top of this, 75,000-plus known software vulnerabilities reported in the National Vulnerability Database, 10,000 security research papers published each year and over 60,000 security blogs published each month - and security analysts are severely challenged to move with informed speed.
Designed on the IBM Cloud, Watson for Cyber Security will be offer cognition of security data at scale, using Watson's ability to reason and learn from 'unstructured data'.
According to IBM, this accounts for 80% of all data on the internet that traditional security tools cannot process, including blogs, articles, videos, reports, alerts, and other information. In fact, IBM analysis found that the average organisation leverages only 8% of this unstructured data.
Watson for Cyber Security also uses natural language processing to understand the vague and imprecise nature of human language in unstructured data. As a result, Watson for Cyber Security is designed to provide insights into emerging threats, as well as recommendations on how to stop them, increasing the speed and capabilities of security professionals, IBM says.
IBM will also incorporate other Watson capabilities including the system's data mining techniques for outlier detection, graphical presentation tools and techniques for finding connections between related data points in different documents. For example, Watson can find data on an emerging form of malware in an online security bulletin and data from a security analyst's blog on an emerging remediation strategy.
"Even if the industry was able to fill the estimated 1.5 million open cyber security jobs by 2020, we'd still have a skills crisis in security," says Marc van Zadelhoff, IBM Security general manager.
"The volume and velocity of data in security is one of our greatest challenges in dealing with cybercrime. By leveraging Watson's ability to bring context to staggering amounts of unstructured data, impossible for people alone to process, we will bring new insights, recommendations, and knowledge to security professionals, bringing greater speed and precision to the most advanced cybersecurity analysts, and providing novice analysts with on-the-job training."
Employing the expertise and resources of universities
IBM plans to collaborate with eight universities that have some of the world's best cybersecurity programmes to further train Watson and introduce their students to cognitive computing, according to the company.
Students will help train Watson on the language of cybersecurity, initially working to help build Watson's corpus of knowledge by annotating and feeding the system security reports and data. As students work closely with IBM Security experts to learn the nuances of these security intelligence reports, they'll also be amongst the first in the world to gain hands-on experience in this emerging field of cognitive security.
This work will build on IBM's work in developing and training Watson for Cyber Security. IBM currently plans to process up to 15,000 security documents per month over the next phase of the training with the university partners, clients and IBM experts collaborating.
These documents will include threat intelligence reports, cybercrime strategies and threat databases. Training Watson will also help build the taxonomy for Watson in cybersecurity including the understanding of hashes, infection methods and indicators of compromise and help identify advanced persistent threats.
IBM says it intends to begin beta production deployments that take advantage of IBM Watson for Cyber Security later this year, according to a statement.
