Why Machine Learning on Its Own Leaves Endpoints Exposed

Machine learning has spread quickly across IT, and cybersecurity is one of the fields where it has clearly worked.

It is the reason defences no longer depend on databases of virus signature files. A signature is a unique set of data or fragments of code that identifies a particular virus, much as a fingerprint identifies a person. Next-generation security products instead learn how threats such as malware behave, which lets them spot malware they have never seen before, without having to wait for an updated signature file.

What a 99% detection rate really means

The numbers suggest machine learning is especially good against malware. Analysis by Crowdstrike, a company that specialises in next-generation endpoint security software, indicates that machine learning solutions detect 99% of malware attacks and even uncover 98% of zero-day attacks, evidence that signature files are no longer essential.

That is a strong result, but it does not mean a business is safe because its odds look good. The figure does not say that 99% of companies escape a successful malware attack. It says that one malware variant in every hundred will slip past a defence based on machine learning. Organised criminals can easily throw 400 to 500 variants at such a system in a short time, and on those odds four or five will get through. A single successful infection is enough to give attackers a "beachhead" inside the network.

There is a second limit. Malware accounts for only about 40% of all kinds of cyber attack, so machine learning by itself cannot deliver the complete endpoint protection companies need.

Looking for the attacker's intent

None of this makes machine learning less important in countering modern threats. It has to work alongside other methods that are better suited to the 60% of attacks that do not rely on malware.

Crowdstrike is cited as a company that pairs machine learning with a wide set of other capabilities and technologies, covering malware as well as exploitation techniques such as stolen credentials, and even state-sponsored actors. Its tools search for what it calls "indicators of attacks", whatever malware or exploit is involved. Understanding what an attacker is trying to achieve, regardless of how they got in, improves the odds of a fast remediation after a breach. That matters because breaches now reportedly go undetected for around six months on average, a period known as "dwell time".

Human hunters fill the gap

Human expertise is the other half of a complete strategy, particularly for remediation and enhanced endpoint detection and response. Hunter teams, made up of security specialists who build a profile of the details particular to a company and understand the motives of the actors targeting it, are becoming essential. Most organisations lack the capability or the budget to employ their own cyber hunters, which is why vendors such as Crowdstrike sell the function as a managed service. Crowdstrike's version is called Falcon Overwatch.

Machine learning remains a vital technology against cyber crime, but it needs a range of other next-generation security technologies and strong endpoint detection and response around it. Only that combination protects adequately against the full range of threats and allows a breach to be contained when one happens.