Machine Learning Methods for Cybersecurity Jaime G. Carbonell Eugene Fink Mehrbod Sharifi

 Automatically adjust security settings based on personal and contextual information  Apply crowdsourcing to detect “advanced” threats that go beyond software attacks, such as scams, rip-offs, and wrong info 2 Application of machine learning and crowdsourcing to adapt cybersecurity tools to the needs of individual users. Research goals

 Personalized security settings  Help the user with security decisions  Adapt to the user needs and preferences  Crowdsourced threat detection  Offer users the option to enter their opinions and warnings about web pages  Automatically analyze the user opinions and combine them with other indicators 3 Initial work

Inflexibly engineered tools with “too much security” and insufficient customization.  Settings and prompts are confusing for nontechnical users  Many users are unable to customize security tools and always respond yes to prompts For example, 90% ignored the certificate issue of IE7 for banking tasks (Sunshine et al., 09). 4 Security problems

 Represent relevant data by a set of models  Learn probabilistic graphical model and use inference 5 E T K U S Q H Third-party model Task model User model User-knowledge model Questions Security-setting model E1 Start End A0 A1 A2 E2 A3 E1. Is more information needed? E2. Is making decision on behalf of the user possible? Yes No A0. Identify the user and context. A1. Collect more observations or ask targeted questions. A2. Answer security questions or adjust security settings. A3. Explain the options in more understandable terms. Personalized security settings History

6 PSA: Personal security assistant

 Dialog box helper  Record the user responses to dialog boxes  : Make decisions on behalf of the user, based on the learned preferences and the current context  : Provide customizable explanations 7  Learning from the user behavior  Log the user activity  Transmit the data to the server

 Collect metrics for web hosts: IP addresses, whois info, blacklists, …  Aggregate user notes  Enable users to provide notes on their experiences with specific web pages  Summarize available notes  Analyze sentiments and biases  Integrate collected metrics, user-note analysis, and other available indicators 8 Crowdsourced threat detection

A browser plug-in for the gathering, sharing, and integration of opinions and warnings about web pages. 9 Available at SmartNotes

10