Machine Learning
Machine learning is a branch of artificial intelligence. In cybersecurity, it is used to analyse files, data streams or behaviour. A model learns from pre-labelled data, then applies what it has learnt to assess items it has never encountered before, without a rule having been written in advance for each case.
What is the purpose of machine learning in cybersecurity?
Machine Learning is used at several stages of a detection chain. In particular, it is used to classify a file as benign or malicious, to identify abnormal behaviour in a network flow, or to prioritise alerts flagged to a security team. A model trained on examples of both benign and malicious files can assign a threat score to an unknown file, without relying solely on a signature database.
Machine Learning and Deep Learning: what is the difference in terms of detection?
Deep Learning is a sub-category of Machine Learning. In malware detection, the distinction lies mainly in the way the model identifies the characteristics of a malicious file. A traditional machine learning model usually relies on features defined by an expert, whereas a deep learning model learns these features independently from the data. The two approaches are complementary and often coexist within the same detection system.
How does GLIMPS use Machine Learning?