#HITBGSEC 2018 COMMSEC: Cognitive Automation With Machine Learning In Cybersecurity

### Overview Presented at #HITBGSEC 2018 COMMSEC, the talk explores how cognitive automation and machine learning (ML) transform cybersecurity operations and risk management. The speaker, a security professional with over eleven years of experience across banking and defense projects, outlines the shift from legacy cryptographic protections to modern defense mechanisms required to counter dynamic infrastructure threats, zero-days, and complex attacks.

### Key Topics - **Evolution of Cyber Threats:** The cybersecurity landscape historically focused on mathematical cryptography, hashing, and password brute-forcing in the 1980s and 1990s. Post-2000, threats expanded to viruses, worms, infrastructure attacks, and distributed denial of service (DDoS), rendering manual controls insufficient. - **Cognitive Automation & Machine Learning Workflow:** Cognitive automation combines adaptive learning, natural language processing, speech recognition, and regular expressions to automate repetitive processes, reduce human error, and lower costs. The high-level ML pipeline involves data collection, categorization and clustering based on permissions and rules, feature selection (such as payloads or timing metrics), dataset creation, and continuous training with real-world data. - **Operational Cybersecurity Applications:** ML enhances several frontline operations, including spam mitigation (e.g., Gmail and Outlook inbox categorization), anti-phishing, user identity theft detection, and data loss prevention (DLP) via automated data classification and labeling.

### Technical Details - **Incident and Fraud Detection:** Traditional fraud detection relied heavily on manual verification and user notifications, resulting in medium processing speeds and medium accuracy due to human error. ML models enable real-time anomaly detection, achieving low human intervention, high speed, and approximately 98% accuracy. For external incident detection (such as brute-force attempts), timing metrics at the microsecond or nanosecond scale are analyzed to distinguish automated scripts from human users. - **Event-Based Cyber Risk Architecture:** The speaker illustrates an architecture for event-based analysis using proxies, SIEM platforms, and network monitoring. Network flows from endpoints, servers, and data centers pass through a proxy server and feed into two analytical tracks: a forensic SIEM (handling incident verification, severity determination, event reconstruction, and post-event root cause analysis) and a real-time SIEM (providing real-time alerting, threat correlation, and enterprise log management). - **Data Standardization & Control Prediction:** Because disparate tools generate divergent reports, a common frame connector is required to normalize data into standardized event datasets. These aggregated datasets feed an analytical engine that performs deep packet analysis, NetFlow inspection, threat intelligence matching, and behavioral monitoring to predict required information security controls and evaluate organizational risk appetite.

### Takeaways Machine learning and cognitive automation provide the adaptive, self-updating mechanisms necessary to match evolving cyber threats. By automating routine analysis, correlating real-time events, and continuously updating detection rules, organizations can decrease risk impact, optimize network defenses, and maintain consistent regulatory compliance across different geographic regions.