35

No. Neural networks are pattern matchers. They're very good pattern matchers, but pattern matchers just the same. No more advanced than the biological brains they are intended to mimic. More thorough, more tireless, but not more sophisticated. The patterns have to be there to be found. There has to be a bias in the data to tease out. But cryptographic ...


9

UPDATE given your comment: I know that it would be computationally unfeasible. I just wanted to know if it would be theoretically possible (it seems not according to tylerl) Yes, given infinite time and infinite energy, a neural net could crack SHA256. BUT (and I think this is the point @tylerl is making) because hash functions have no discernible ...


9

From a different angle: You could reduce it to the open problem "does there exist an efficient algorithm for integer factorization". If such an algorithm exists, a NN could discover it via guided proof search, and that could be used to undermine all of security.


8

This is absolutely possible. Whether or not reCaptcha itself or any other given captcha service does this, I don't know, but biometrics based on mouse movements are absolutely able to uniquely identify people. The same is true for many other ways we interact with our computers (e.g. our keyboards). There are a large number of research papers on various ...


5

"Can a Neural Network become the 'inverse function' of a hash function?" Maybe. There is no mathematical proof that any given hash function, be it SHA or any other, lacks patterns between Domain and Image. As other answerers have pointed out, hash functions are explicitly designed such that there are no known preserved qualities. If there is some sort of ...


3

No, Neural networks fundamentally use gradient decent optimization. Neural networks are an interesting family of functions and in practice we manage to optimize over them rather well despite not being a convex problem. For any such optimization technique to work we need some minimal amount of smoothness, we need a notion of almost correct. We don't have ...


3

Machine learning technology is certainly better in scope compared to signature based systems. To your example about SQLi attacks, signatures could look for specific commands/strings within the HTTP payload as means for detection. ML based approach can, instead, define the behavior as process spawned on the db server or unwanted read-only operations etc etc. ...


3

Neural network or any other machine learning algorithms are not magic, even if it might look like this. At the end these methods are just a bunch of equations (i.e. math) to map input to output and the learning is adjusting the parameters for this equations so that the result reflects the training data as best as possible. This way it tries to learn the ...


3

IoT security is currently so poor that there are endless opportunities for improving the state of the art using machine learning. First, pick an area of IoT that you're interested in. I'd recommend you pick one where you already have existing systems you can leverage, and where monitoring/sniffing tools are widely available. Do you have a home automation ...


2

Virus scanners that look for suspicious activity are often referred to as using heuristic analysis. It may run an application in some sort of sandbox (a special virtual machine) to analyse the program's behaviour. It will look for common virus activity such as replication and attempts to conceal itself. As new viruses are discovered, antivirus ...


2

The traditional technique described sounds like a signature- and host-based intrusion detection system. (IDS is a broad term that includes antivirus software.) Some systems detect known patterns of bad behaviour, in addition to known bad data. These pattern definitions are not dynamic, so you might still consider them to be "signatures". In consumer ...


2

Yes, there are recent examples of attackers targetting ML systems in order to later evade detection. The term used for the study of this effect is "Adversarial Machine Learning". There are a number of papers: Berkeley, 2010 Berkeley, 2011 IEEE, 2011 One of the techniques discussed is the "boiling frog" technique. Named after the effect that one can boil a ...


2

This may not be a popular opinion (cue comments), but I am not a fan of Machine Learning being used in the security industry. I'm always skeptical when it seems like the approach is "We don't know how to solve this problem. I know! Let's throw ML at it!!". There are of course niches within security where ML seems to be doing ok-ish, for example detecting ...


2

This is not just an issue with 3rd parties - banks have strict regulations about what PII they can use in development environments if controls are not up to the same strictness as production environment. The usual route is anonymisation or pseudo-anonymisation. From https://gdpr.report/news/2017/11/07/data-masking-anonymisation-pseudonymisation/: With ...


1

I think you are using the wrong tool for the wrong problem. Why not inspect the attachment for malicious code? What does pairing the content of both things gain you? Also, you appear to have an underlying assumption about the disconnect between the two contents. Why do you think that the attachment content would not match the email content? What if ...


1

In general security systems that use a machine learning approach are based on features, metrics or characteristics. Depending on the area (Anti-Virus, Anti-spam, NIDS) the characteristics are different. For example: In the area of Spam the subject will be a key characteristic as well as if the message have an attachment and the attachment could contain ...


1

I believe the IP address provides useful information. IP addresses can be "spoofed" in the connectionless protocols like UDP and ICMP. If you're worried about DDoS attacks via traffic amplification, the spoofed address is almost critical to discovering what's going on. Connection-oriented protocols like TCP or SCTP are far harder to spoof (though BGP ...


1

Are there any real instances of attacks against machine learning systems? Probably the most well known systems based on ML in information security are spam filters. Since sending spam is a lucrative business these filters get attacked a lot by making they look more like non-spam for a machine. Many of the attacks target the feature extraction, for example ...


Only top voted, non community-wiki answers of a minimum length are eligible