Machine Learning in Web Security
Machine learning has gone from a buzzword to something we use in production every day. The idea is simple: instead of being given rules, the computer learns from data. In web security, that changes things for both attackers and defenders.
Attackers
Earlier this year, researchers from Yale, Stanford, Oxford and Cambridge published a paper warning about how ML can be misused. Some of what they describe is already happening:
- Hivenets: botnets that evolve from simple networks of bots into self-learning systems.
- Attackers using predictive models that get more precise with every iteration.
- Phishing that gets more convincing as natural language processing improves.
Defenders
The same tools work for defense. These are the areas where ML helps us most:
Anomaly detection. A model learns what normal traffic looks like and flags what doesn't fit.
Zero-day exploits. Signatures only catch attacks that are already known. A model that learns how legitimate users behave (we use BigQuery ML for this) can flag behavior that doesn't match, even when no signature exists yet.
Automation. ML takes routine tasks off analysts' plates, so they can spend their time on the cases that need a human.
Prediction. Supervised models trained on past attacks help us anticipate the next ones.
At Reblaze we run a globally distributed security network in the cloud. An attacker who targets a site we protect isn't facing one standalone system. They're facing a network that uses the full power of cloud computing and learns from traffic everywhere it runs.