Story image

A modern solution for a modern problem: IBM tackles cyber security

31 May 2016

IBM is tackling modern security issues with a modern approach: cognitive technology. As part of a year long research project, IBM is rolling out Watson for Cyber Security, a new cloud-based version of the company’s cognitive tech that focuses on the language of security.

IBM Watson is the organisation’s technology platform that uses natural language processing and machine learning to reveal insights from large amounts of unstructured data.

According to a statement, IBM is teaming up with eight universities around the United States to further scale the system and expand the collection of security data that Watson is currently trained with.

According to IBM, training for Watson for Cyber Security is a crucial step in the advancement of cognitive security. At present, Watson is learning the nuances of security research findings and discovering patterns and evidence of hidden cyber attacks and threats that could otherwise be missed. Using cognitive systems that automate the connections between data, emerging threats and remediation strategies further enables security analysts and helps to address the cyber security skills gap.

In order to expand Watson’s understanding of cyber security, IBM is working with a range of universities and their students, including: California State Polytechnic University, Pomona; Pennsylvania State University; Massachusetts Institute of Technology; New York University; the University of Maryland, Baltimore County (UMBC); the University of New Brunswick; the University of Ottawa and the University of Waterloo.

IBM’s X-Force research library will also be a central part of the materials fed to Watson for Cyber Security. This body of knowledge includes 20 years of security research, details on eight million spam and phishing attacks and more than 100,000 documented vulnerabilities.

Understanding and addressing the security skills gap

The volume of security data presented to analysts is vast, according to IBM. For instance, the average organisation sees more than 200,000 pieces of security event data per day, with enterprises spending $1.3 million a year dealing with false positives alone, wasting nearly 21,000 hours.

On top of this, 75,000-plus known software vulnerabilities reported in the National Vulnerability Database, 10,000 security research papers published each year and over 60,000 security blogs published each month - and security analysts are severely challenged to move with informed speed.

Designed on the IBM Cloud, Watson for Cyber Security will be offer cognition of security data at scale, using Watson's ability to reason and learn from ‘unstructured data’.

According to IBM, this accounts for 80% of all data on the internet that traditional security tools cannot process, including blogs, articles, videos, reports, alerts, and other information. In fact, IBM analysis found that the average organisation leverages only 8% of this unstructured data.

Watson for Cyber Security also uses natural language processing to understand the vague and imprecise nature of human language in unstructured data. As a result, Watson for Cyber Security is designed to provide insights into emerging threats, as well as recommendations on how to stop them, increasing the speed and capabilities of security professionals, IBM says.

IBM will also incorporate other Watson capabilities including the system’s data mining techniques for outlier detection, graphical presentation tools and techniques for finding connections between related data points in different documents. For example, Watson can find data on an emerging form of malware in an online security bulletin and data from a security analyst's blog on an emerging remediation strategy.

“Even if the industry was able to fill the estimated 1.5 million open cyber security jobs by 2020, we’d still have a skills crisis in security,” says Marc van Zadelhoff, IBM Security general manager.

“The volume and velocity of data in security is one of our greatest challenges in dealing with cybercrime. By leveraging Watson’s ability to bring context to staggering amounts of unstructured data, impossible for people alone to process, we will bring new insights, recommendations, and knowledge to security professionals, bringing greater speed and precision to the most advanced cybersecurity analysts, and providing novice analysts with on-the-job training."

Employing the expertise and resources of universities

IBM plans to collaborate with eight universities that have some of the world's best cybersecurity programmes to further train Watson and introduce their students to cognitive computing, according to the company.

Students will help train Watson on the language of cybersecurity, initially working to help build Watson's corpus of knowledge by annotating and feeding the system security reports and data. As students work closely with IBM Security experts to learn the nuances of these security intelligence reports, they’ll also be amongst the first in the world to gain hands-on experience in this emerging field of cognitive security.

This work will build on IBM's work in developing and training Watson for Cyber Security. IBM currently plans to process up to 15,000 security documents per month over the next phase of the training with the university partners, clients and IBM experts collaborating.

These documents will include threat intelligence reports, cybercrime strategies and threat databases. Training Watson will also help build the taxonomy for Watson in cybersecurity including the understanding of hashes, infection methods and indicators of compromise and help identify advanced persistent threats.

IBM says it intends to begin beta production deployments that take advantage of IBM Watson for Cyber Security later this year, according to a statement.

Seagate: Data trends, opportunities, and challenges at the edge
The development of edge technology and the rise of big data have brought many opportunities for data infrastructure companies to the fore.
Popular Android apps track users and violate Google's policies
Google has reportedly taken action against some of the violators.
How blockchain could help stop video piracy in its tracks
An Australian video tech firm has successfully tested a blockchain trial that could end up being a welcome relief for video creators and the fight against video piracy.
IBM X-Force Red & Qualys introduce automated patching
IBM X-Force Red and Qualys are declaring a war on unpatched systems, and they believe automation is the answer.
Micro Focus acquires Interset to improve predictive analytics
Interset utilises user and entity behavioural analytics (UEBA) and machine learning to give security professionals what they need to execute threat detection analysis.
Raising the stakes: McAfee’s predictions for cybersecurity
Security teams and solutions will have to contend with synergistic threats, increasingly backed by artificial intelligence to avoid detection.
Exclusive: Ping Identity on security risk mitigation
“Effective security controls are measured and defined by the direct mitigation of inherent and residual risk.”
CylancePROTECT now available on AWS Marketplace
Customers now have access to CylancePROTECT for AI-driven protection across all Windows, Mac, and Linux (including Amazon Linux) instances.