Symantec Adds Deep Learning to Anti-Malware Tools to Detect Zero-Days

By Wayne Rash  |  Posted 2016-01-02 Print this article Print
Symantec Anti-malware

"This doesn't scale. We needed technology to let this scale beyond the bottleneck of human review."

This is the sort of area where deep learning really shines. By feeding the deep learning system a vast quantity of information about email attacks, the deep learning process can learn to recognize an attack, and also learn to recognize when something isn't an attack. "We can hit 98 percent accuracy over human tests. We can offer something that catches targeted emails," he said, referring to spear phishing emails.

However, Gardner said that a big part of the challenge is moving beyond the traditional way of looking at security in order to take advantage of the power of deep learning. "My sense is that we have a sort of an echo chamber view of how we go about detecting things," he saidHe noted that humans aren't scalable, which is why the deep learning process works so well. "Deep learning learns from data," Gardner said. "The first ingredient is big data. That's when it takes over and does well."

Gardner depicts the process of using big data to feed deep learning by describing how someone might want to filter social media data for cat videos. "You can recognize a cat," he explained, but the difference is that you probably can't recognize a malware attack. "If I give you tables of security data, how do you make sense of that?" The difference is that with enough security data the deep learning process can tell when a security event is happening and when it's not.

While Symantec will deploy deep learning in Norton Mobile Security, Symantec plans to offer deep learning as part of its email offerings, which work with Microsoft Exchange and Microsoft Office 365 and with Google Apps sometime in 2016. However, Gardner didn't specify a launch date. A company spokesperson told eWEEK that the new security offering will be available to companies of any size at a reasonable cost.

Gardner cautioned that as powerful as deep learning may be, it can't be the only security solution. "When we talk about deep learning, it's about asking how close is it to a targeted attack?" he said. But he also notes that while deep learning may be very close, "You can't ever prevent all attacks."

"Farther down the stack, deep learning may not be the only thing you need," Gardner said, noting that you can't just look at one type of anomaly. "We have a ways to go before deep learning is available out of the box, but we're getting there," he said.


Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel