I have to choose a field to study on and I want to know does it worth studying in this field and will the future IDS/IPS systems be using machine-learning/deep-learning or at least how likely is it?

i heard that some companies showed their IDS/IPS systems that were using machine learning in the recent defcon but I don't know how successful were they compared to normal IPS/IDS (by normal i mean not using machine learning or deep learning for detecting intrusion) systems and how likely is it to see a commercial IPS/IDS in the near future that performs better than a normal IDS/IPS?

do you guys think its worth to be studying on this field to develop better IDS/IPS systems?

Also what about just malware detection using machine learning?

closed as primarily opinion-based by schroeder Sep 29 '18 at 19:52

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Can you describe what you exactly consider a "normal" IDS? Do you mean static, manually created, signatures and manual configuration which signatures should be used and manually looking through all the alerts and deciding which are relevant and which were false positives? – Steffen Ullrich Sep 29 '18 at 12:25
  • @SteffenUllrich i meant an IDS that doesn't use machine learning or deep learning to detect intrusions, sorry for confusion, i edited the question. – AlenT Sep 29 '18 at 15:59
  • Unfortunately, we can only guess what technologies will be used in the future, and would have to guess even further to opine on whether they will be effective. As such, I am going to have to close as "opinion-based". Also, there is a TON of material out there where analysts discuss this very topic. – schroeder Sep 29 '18 at 19:52

I think nowadays a lot of companies needs to add the words "Machine Learning" and "AI" to their products basically. But they still using the same technology as before with these new features. When a vendor shows me how cool is their solution I always ask about the detection numbers (false positives, false negatives, data sets, reaction time when a new malware is active and so on), basically I don't care of what they use behind the curtains but I care about the other metrics that are the ones that may impact me.

  • Any sufficiently advanced statistical analysis will be labeled as "AI" by a marketing department at some point. Full disclosure: I developed behaviour anomaly detection algorithms for UBA products. – schroeder Sep 29 '18 at 19:54

Not the answer you're looking for? Browse other questions tagged or ask your own question.