F Your ML Model

The talk opens with the speaker's first encounter with machine learning, then argues that it is not the right tool for every problem. Many hard problems are better served by other methods from the wider AI field, and the speaker questions why security rarely uses them.

The core of the talk covers AI planning, which represents states and actions with logic to reach a goal. The speaker walks through a game-AI planner from the shooter F.E.A.R. and then builds a small planner that responds to account takeover risk, such as forcing password resets, ending sessions and alerting, in the style of a security orchestration platform. Next comes mathematical optimization: a planning problem is recast as an objective function with constraints, and the speaker notes that a neural network is also a function being optimized. A weapon-target assignment model, implemented in Python with an algebraic modeling library and an open-source solver, is then mapped onto security controls and attacks to show how trade-offs could guide where teams spend effort. The talk closes with logic programming, where relations are used to derive a planning graph, which the speaker acknowledges is a somewhat hacky approach.

The takeaway for practitioners is to translate a security problem into different representations and then choose the solving method that fits its constraints, rather than defaulting to machine learning. The demonstrations are conceptual and the code is illustrative.