Lie back and think of cybersecurity: IBM lets students loose on Watson
IBM is teaming up with eight North American universities to further tune its cognitive system to tackle cybersecurity problems.
Watson for Cyber Security, a platform already in pre-beta, will be further trained in “learning the nuances of security research findings and discovering patterns and evidence of hidden cyber attacks and threats that could otherwise be missed”. IBM will work with eight north American universities from autumn onwards for a year in order to push forward the project.
The universities selected are California State Polytechnic University, Pomona; Pennsylvania State University; Massachusetts Institute of Technology; New York University; the University of Maryland, Baltimore County (UMBC); the University of New Brunswick; the University of Ottawa; and the University of Waterloo.
The project is ultimately designed to bridge the cyber-security skills gap, a perennial issue in the industry. In much the same way experts systems already help doctors, Big Blue hopes its cloud-based tech can give security analysts a boost in repelling hacking attacks and malware.
“IBM’s efforts are designed to improve security analysts’ capabilities using cognitive systems that automate the connections between data, emerging threats and remediation strategies,” the IT giant explains. “IBM intends to begin beta production deployments that take advantage of IBM Watson for Cyber Security later this year.”
IBM’s X-Force research library will be a central part of the materials fed to Watson for Cyber Security. This body of knowledge includes 20 years of security research, details on 8 million spam and phishing attacks and over 100,000 documented vulnerabilities.
This sort of material strikes El Reg’s security desk as far more valuable than anything university student, however bright, may be able to offer.
Sysadmins and IT consultants, to give just two examples, might be expected to be better versed in the realities of security work and practical threats ranging from sloppy passwords practices to phishing and legacy systems running out-of-date software.
And if the lexicon of security needs comprehension then it’d be better to call in an ex soldier or airman. That’s because the infosec (sorry cyber security) biz is guilty of re-appropriating military terms such as APT en masse.
IBM said collaborating with eight universities that have “some of the world's best cybersecurity programs” will help “further train Watson and introduce their students to cognitive computing”.
Students will help train Watson on the language of cybersecurity, initially working to help build Watson's corpus of knowledge by annotating and feeding the system security reports and data.
As students work closely with IBM Security experts to learn the nuances of these security intelligence reports, they’ll also be amongst the first in the world to gain hands-on experience in this emerging field of cognitive security. This work will build on IBM's work in developing and training Watson for Cyber Security. IBM currently plans to process up to 15,000 security documents per month over the next phase of the training with the university partners, clients and IBM experts collaborating.
Stripped of spin, this looks a lot like an internship with IBM in cybersecurity, which will certainly look good on any young person’s CV and may steer them towards a career in cybersecurity further on down the road. But the actual work sounds like document review in a legal firm and sounds like it might involve data entry and clerical duties. The absence of any collaboration with universities outside North America also suggests that we’re talking internships rather than international collaborative research.
Students can expect to be handling documents including threat intelligence reports, cybercrime strategies and threat databases. Training Watson will also help build the taxonomy for Watson in cybersecurity including an understanding of hashes, infection methods and indicators of compromise to help identify advanced persistent threats (cyber-espionage).
IBM’s strategy essentially involves applying Big Data techniques in order to get a better handle on security incident response. Splunk, RSA, Symantec and others are following a broadly similar but by no means identical route. Big Blue places more emphasis than most on using expert systems and Big Data to tackle the cybersecurity skills gap, as its pitch explains.
The volume of security data presented to analysts is staggering. The average organisation sees over 200,000 pieces of security event data per day with enterprises spending $1.3 million a year dealing with false positives alone, wasting nearly 21,000 hours.
Couple this with 75,000-plus known software vulnerabilities reported in the National Vulnerability Database3, 10,000 security research papers published each year and over 60,000 security blogs published each month – and security analysts are severely challenged to move with informed speed.
Designed on the IBM Cloud, Watson for Cyber Security will be the first technology to offer cognition of security data at scale using Watson's ability to reason and learn from "unstructured data" – 80 percent of all data on the internet that traditional security tools cannot process, including blogs, articles, videos, reports, alerts, and other information. In fact, IBM analysis found that the average organization leverages only 8 percent of this unstructured data. Watson for Cyber Security also uses natural language processing to understand the vague and imprecise nature of human language in unstructured data.
Watson for Cyber Security is designed to provide “insights into emerging threats, as well as recommendations on how to stop them”. IBM will also incorporate other Watson capabilities including the system’s data mining techniques for outlier detection, graphical presentation tools and techniques for finding connections between related data points in different documents. For example, Watson can find data on an emerging form of malware in an online security bulletin and data from a security analyst's blog on an emerging remediation strategy.
“Even if the industry was able to fill the estimated 1.5 million open cyber security jobs by 2020, we’d still have a skills crisis in security,” said Marc van Zadelhoff, general manager, IBM Security, in a statement.
“The volume and velocity of data in security is one of our greatest challenges in dealing with cybercrime. By leveraging Watson’s ability to bring context to staggering amounts of unstructured data, impossible for people alone to process, we will bring new insights, recommendations, and knowledge to security professionals, bringing greater speed and precision to the most advanced cybersecurity analysts, and providing novice analysts with on-the-job training."
In related news, University of Maryland, Baltimore County also announced a multi-year collaboration with IBM Research to create an Accelerated Cognitive Cybersecurity Laboratory. Lecturers and students will apply cognitive computing to complex cybersecurity challenges to build upon their own prior research. They will also collaborate with IBM scientists and leverage IBM's advanced computing systems to add speed and scale to new cybersecurity services and technologies.
Which is nice.
More on IBM’s work on cognitive security can be found here. ®