ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum,...

31
1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

Transcript of ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum,...

Page 1: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1

ML & Deep Learning

THB, 13. Security Forum, 17.01.2019

Gewinn oder Gefahr für die Security?

David Fuhr

Page 2: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

2

ML & Deep Learning

THB, 13. Security Forum, 17.01.2019

Gewinn oder Gefahr für die Security?

David Fuhr

Page 3: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

33 © HiSolutions 2019

• Mathematik

• Krypto(graphie)

• Security

• Coaching

David FuhrHead of Research, HiSolutions AG

Page 4: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

4

Digital Security Netzwerk Berlin e.V.

• Gründung und Projektstart November 2018, Aufnahme operative Geschäftstätigkeit 1.1.2019

• Aktuell 10 Gründungsmitglieder

• Ausgangslage der Gründung: Marktanalysen von SenWTF IT-Security in Berlin-Brandenburg

• 4 Arbeitspakte:

• AP 1 Kooperation mit Hochschulen und Forschungseinrichtungen (Fachkräftegewinnung)

• AP 2 Kooperation mit Kritis-Bereichen aus der Innovationsstrategie (InnoBB)

• AP 3 Projekte und Initiativen (gemeinsame Akquisition)

• AP 4 Entwicklung eines IT-Sicherheitschecks für KMU

• Netzwerkförderung (GRW-Netzwerk) seitens SenWTF

• Weitere Infos: Stand des Clusters IKT, Medien und Kreativwirtschaft

Page 5: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

5

Ziele des Digital Security Netzwerk Berlin

1. Zusammenwachsen der IT-Security-Branche – regionale Kooperationen fördern

2. Zusammenarbeit von Wissenschaft und Wirtschaft im Bereich IT-Security verbessern

3. Kooperation mit Hochschulen und Forschungseinrichtungen optimieren -> Fachkräftegewinnung

4. Kompetenznetzwerk (POC) und vertrauenswürdiger Ansprechpartner in der Hauptstadtregion

5. Gemeinsam Projekte für die Hauptstadtregion akquirieren

6. Kooperation mit anderen Wirtschaftsbereichen (KRITIS und Clusterbereiche der gemeinsamen Innovationsstrategie) intensivieren -> Querschnittcharakter der IT-Sicherheit gerecht werden

7. Umdenken in Prozessen und Systemen anstoßen, Security-Awareness stärken

8. Austausch mit der wachsenden Startup-Szene in Berlin

Weitere Infos: Stand des Clusters IKT, Medien und Kreativwirtschaft

Page 6: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

66 © HiSolutions 2019

Page 7: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

7 © HiSolutions 2019

Page 8: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

88 © HiSolutions 2019

Page 9: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

99 © HiSolutions 2019

Page 10: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1010 © HiSolutions 2019

DATA SCIENTIST / AI RESEARCHER

Page 11: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1111 © HiSolutions 2019

Page 12: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1212 © HiSolutions 2019blogs.balbix.com

Page 13: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1313 © HiSolutions 2019blogs.balbix.com

Page 14: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

1414 © HiSolutions 2019

www.datasciencecentral.com

Page 15: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

15 © HiSolutions 2019

Man vs. Machine

…threatens Human Machine

HumanCivil/Military

SecurityInfoSec ……

Cyberwar

Machine Safety War of Machines

[Liggesmeyer 2015]

Page 16: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

16 © HiSolutions 2019

AI Security?

▪ AI for Security

▪ Security of/for AI

▪ Security from/against AI

▪ Security because of / thanks to AI

▪ AI against Security / Security in spite of AI

▪ …?

Page 17: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

17 © HiSolutions 2019

Man vs. AI vs. Machine

…threatens Human AI Machine

Human Civil/Military Security AI-Sec InfoSec

AI AI Safety Adversarial Sec AI

Machine Safety (e.g. Safety AI) (AI-Sec) War of Machines

Page 18: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

18 © HiSolutions 2019

Adversarial: AI vs. AI

▪ Sparring: GANs (Generative Adversarial Networks, 2014)

▪ Fight: CGC (DARPA Cyber Grand Challenge 2016)

Page 19: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

19 © HiSolutions 2019

AI-Sec: Humans vs. AI

▪ Humans (or nature) trying to harm a piece of software

▪ (on purpose or bad luck (e.g., fat finger))

→This we know!

→See InfoSec

Page 20: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

20 © HiSolutions 2019

AI-Sec: Humans vs. AI

▪ Availability: Depending on (Cloud) resources, model parameters, data

▪ Confidentiality: Trade secrets in models

▪ Integrity:

▪ Manipulation of evaluation

▪ Manipulation of models

▪ Manipulation of data

▪ Manipulation of AI stacks (source code, binaries)

▪ Manipulation of supply chain

It’s all going to happen.

Page 21: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

21 © HiSolutions 2019

Sec-AI: AI vs. Machines

▪ Offensive AI

▪ Defensive AI

https://xkcd.com/

Page 22: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

22 © HiSolutions 2019

Incorrect View of InfoSec (Dullien 2017)

Thomas Dullien 2017, https://doc.dustri.org/keynotes/Machine%20Learning,%20Offense,%20and%20the%20future%20of%20Automation%20-%20Halvar%20Flake%20-%20ZeroNights%202017.pdf

https://doc.dustri.org/keynotes/Machine Learning, Offense, and the future of Automation - Halvar Flake - ZeroNights 2017.pdf
Page 23: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

23 © HiSolutions 2019

More Realistic View of InfoSec (Dullien 2017)

Thomas Dullien 2017, https://doc.dustri.org/keynotes/Machine%20Learning,%20Offense,%20and%20the%20future%20of%20Automation%20-%20Halvar%20Flake%20-%20ZeroNights%202017.pdf

https://doc.dustri.org/keynotes/Machine Learning, Offense, and the future of Automation - Halvar Flake - ZeroNights 2017.pdf
Page 24: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

24 © HiSolutions 2019

The Good, the Bad & the Ugly

Task Today Future Action

SPAM detection Near perfect SPAM evasion might win → Learn about useful/fruitful content

Virus detection Mostly non-AI Not to change that fast (what is

„evil“ behavior?)

Wrong idea anyways ;-)

→ Whitelisting, hardening,

true software engineering

„Anomaly

detection“

AI marketing hype Will work in simple/strict

environments

→ Ditto

Vuln scanning Some AI hype Mostly useless (hacking is

about exploiting minor glitches)

→ Can work on a macro level

Attribution „It was the

Russinese!“

Please don‘t. → Forget about it!

Config

Management

Non-AI Promising („most servers that

were not hacked did X“)

→ Start doing Config management

→ Use AI to make it cooler

Other What is AI? Lots of hidden wins → Start researching

Page 25: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

25 © HiSolutions 2019

AI Safety: AI vs. Humans

- Opacity (vs. Transparency)

- Bias

- Singularity

Page 26: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

26 © HiSolutions 2019

AI Safety: AI vs. Humans

- Opacity (vs. Transparency)

- Transparency as crucial for democracy: Trust, Accountability

- → Also a chance?

- Bias

- Cannot be avoided (part of culture), but:

- We need to stay fluid vs. power

- Stakeholder problem (bias in professional field)

- → Always ask and invite those discriminated against

- Singularity

- Actually a scale

- Start researching and mitigating early(!!!)

Page 27: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

27 © HiSolutions 2019

Who Will Win?

▪ Attacker or Defender?

▪ In (pre AI) InfoSec:

▪ It depends.

▪ Used to say: attacker

▪ New insight:

▪ locally: attacker

▪ globally: defender

▪ but: cyberwar

https://xkcd.com/

Page 28: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

28 © HiSolutions 2019

Who Will Win with AI / Post-AI?

▪ Defenders need to keep wining (statistically, without black swans)

→ New type of defenders and defenses needed

→ More research necessary

https://xkcd.com/

Page 29: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

29 © HiSolutions 2019

Man vs. AI vs. Machine

…threatens Human AI Machine

Human Civil/Military SecurityAI-Sec

- New Attack VectorsInfoSec

AI

AI Safety

- Opacity

- Bias

- Singularity

Adversarial:

- GANs

- CGC

Sec AI

- Offensive AI

- Defensive AI

MachineSafety

(e.g. Safety AI)(AI-Sec) War of Machines

Page 30: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

30 © HiSolutions 2019

Lessons To Be (Deeply) Learned

▪ We (AI & InfoSec communities) need to talk.

▪ Now.

▪ Learn about

▪ Threat Modeling

▪ Attacks/Attack vectors

▪ Risk Analysis and Risk Management

▪ Security by Design, Security by Default

▪ Accountability

▪ Transparency

▪ And have fun doing it!

Page 31: ML & Deep Learning - Security Management€¦ · 1 ML & Deep Learning THB, 13. Security Forum, 17.01.2019 Gewinn oder Gefahr für die Security? David Fuhr

3131 © HiSolutions 2019

Bouchéstraße 12 | 12435 Berlin

[email protected] | +49 30 533 289 0

www.hisolutions.com

Vielen Dank! Fragen?

David [email protected]


Manual: InterPlay Mammalian TAP SystemStreptavidin resin (#240105)b 1.25 ml 1.25 ml — — 1.25 ml — Streptavidin binding buffer (SBB) 25 ml 25 ml — — 25 ml 25 ml Streptavidin

Manual: InterPlay Mammalian TAP SystemStreptavidin resin (#240105)b 1.25 ml 1.25 ml — — 1.25 ml — Streptavidin binding buffer (SBB) 25 ml 25 ml — — 25 ml 25 ml Streptavidin

Studies Improving Health - Buckeye International · 2017. 9. 18. · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml Vivid

Studies Improving Health - Buckeye International · 2017. 9. 18. · 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml 1250 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml & 1000 ml Vivid

x Ml Security

x Ml Security

ML-2240 & ML-2245 & ML-1640 Series training February 2008diagramasde.com/diagramas/otros2/ml-1640, ml-2240... · ML-2240 & ML-2245 & ML-1640 Series training February 2008 ML-2240

ML-2240 & ML-2245 & ML-1640 Series training February 2008diagramasde.com/diagramas/otros2/ml-1640, ml-2240... · ML-2240 & ML-2245 & ML-1640 Series training February 2008 ML-2240

Sin título-1 › media › k2 › attachments › Bimeda... · PRESENTACIÓN CAPRINOSL 500 ml 500 ml 500 ml 500 ml 50 ml 500 ml IL IL 6.4 g 23.6 g 100 ml 100 ml 250 ml 250 ml 475

Sin título-1 › media › k2 › attachments › Bimeda... · PRESENTACIÓN CAPRINOSL 500 ml 500 ml 500 ml 500 ml 50 ml 500 ml IL IL 6.4 g 23.6 g 100 ml 100 ml 250 ml 250 ml 475

Samsung ML-1510 ML-1710 ML-1750

Samsung ML-1510 ML-1710 ML-1750

A1000 series (50 ml, 100 ml & 250 ml)

A1000 series (50 ml, 100 ml & 250 ml)

REPLACEMENT PARTShs series automatic slicers (ml-136313 thru ml-136324) ml-136313 hs7 ml-136314 hs7n ml-136317 hs7 (canada) ml-136318 hs7n (canada) ml-136324 hs7-phs

REPLACEMENT PARTShs series automatic slicers (ml-136313 thru ml-136324) ml-136313 hs7 ml-136314 hs7n ml-136317 hs7 (canada) ml-136318 hs7n (canada) ml-136324 hs7-phs

Osx Ml Tt Security

Osx Ml Tt Security

GEWINN Infra LLP Company Profilegewinn.in/doc/gewinnComProfile.pdf · GEWINN Infra LLP –Company Profile. Introduction A. GEWINN Infra LLP B. Head Office –Mumbai C. Representative

GEWINN Infra LLP Company Profilegewinn.in/doc/gewinnComProfile.pdf · GEWINN Infra LLP –Company Profile. Introduction A. GEWINN Infra LLP B. Head Office –Mumbai C. Representative

ML-Retail-Catalog - Larsen · SECURITY CENTRE SECURITY CENTRE SECURITY CENTRV SECURITY CENTRE . TRAVEL a SECURITY . Title: ML-Retail-Catalog.pdf Author: mblatchly Created Date

ML-Retail-Catalog - Larsen · SECURITY CENTRE SECURITY CENTRE SECURITY CENTRV SECURITY CENTRE . TRAVEL a SECURITY . Title: ML-Retail-Catalog.pdf Author: mblatchly Created Date

Final - English · English Breakfast 20 Camomile 20 Earl Grey 20 350 ml 350 ml 250ml 1800 ml 1800 ml 135 ml 750 ml 135 ml 300 ml 300 ml. Title: Final - English Created Date: 7/24/2018

Final - English · English Breakfast 20 Camomile 20 Earl Grey 20 350 ml 350 ml 250ml 1800 ml 1800 ml 135 ml 750 ml 135 ml 300 ml 300 ml. Title: Final - English Created Date: 7/24/2018

d163axztg8am2h.cloudfront.net...Analysis Volume 100 ml IOO ml 400 ml IOO ml 50 ml 50 ml 200 ml 50 ml 500 ml 300 ml IOO ml 25 ml 500 ml 200 ml IOO ml 200 ml EPA Method # 305 310 350

d163axztg8am2h.cloudfront.net...Analysis Volume 100 ml IOO ml 400 ml IOO ml 50 ml 50 ml 200 ml 50 ml 500 ml 300 ml IOO ml 25 ml 500 ml 200 ml IOO ml 200 ml EPA Method # 305 310 350

Man vs. Machine: Adversarial Detection of Malicious ... · Machine Learning for Security • Machine learning (ML) to solve security problems – Email spam detection – Intrusion/malware

Man vs. Machine: Adversarial Detection of Malicious ... · Machine Learning for Security • Machine learning (ML) to solve security problems – Email spam detection – Intrusion/malware

 · DIGITAL SCALE GEWINN ww%'.gewinngold.com GEWINN DIGITAL SCALE CATALOGUE MANUFACTURE, SALES, SERVICE SPARE PART, CONTRACT SERVICE, TERA • CALIBRATION CONTROL & SYSTEM, PROGRAMMING

 · DIGITAL SCALE GEWINN ww%'.gewinngold.com GEWINN DIGITAL SCALE CATALOGUE MANUFACTURE, SALES, SERVICE SPARE PART, CONTRACT SERVICE, TERA • CALIBRATION CONTROL & SYSTEM, PROGRAMMING

AI, ML & Cybersecurity · information on the core security operations and minimum requirements to implement a successful security program. •Provide input to technical standards:

AI, ML & Cybersecurity · information on the core security operations and minimum requirements to implement a successful security program. •Provide input to technical standards:

BO 100311 - cdnmedia.eurofins.com · > AK TIE: EUROFINS SCIENTIFIC Gewinn angepeilt ie Notiz von Eurofins Scientific dreht an der Unterstützungslinie bei 30 Euro wieder nach oben.

BO 100311 - cdnmedia.eurofins.com · > AK TIE: EUROFINS SCIENTIFIC Gewinn angepeilt ie Notiz von Eurofins Scientific dreht an der Unterstützungslinie bei 30 Euro wieder nach oben.

Internet deserve the best protection Worldwide recognition ...cdn.billiger.com/.../Panda-Security-Internet-Security-2012-ML...73e04… · Panda Internet Security 2012 for Netbooks

Internet deserve the best protection Worldwide recognition ...cdn.billiger.com/.../Panda-Security-Internet-Security-2012-ML...73e04… · Panda Internet Security 2012 for Netbooks

REPLACEMENT PARTS · 2015-03-25 · legacy mixer series hl120 ml-134296 hl120 ml-134459 hl200 ml-134289 hl200 ml-134331 hl200 ml-134455 hl200 ml-134457 hl200 ml-134458 hl200c ml-134456

REPLACEMENT PARTS · 2015-03-25 · legacy mixer series hl120 ml-134296 hl120 ml-134459 hl200 ml-134289 hl200 ml-134331 hl200 ml-134455 hl200 ml-134457 hl200 ml-134458 hl200c ml-134456

s3466e9c715dd639e.jimcontent.com fileRomy FAIsST Business Circle Mag. Martina ERNST Mag. Michael GEWINN 6/07 Martin DALL HAS Ing. Ulrike FROHN KARRIERE & WEITERBILDUNG GEWINN-lJmfrage:

s3466e9c715dd639e.jimcontent.com fileRomy FAIsST Business Circle Mag. Martina ERNST Mag. Michael GEWINN 6/07 Martin DALL HAS Ing. Ulrike FROHN KARRIERE & WEITERBILDUNG GEWINN-lJmfrage: