Detecting and mitigating automated attacks involves understanding the difference between human and automated traffic.
Joshua Goldfarb, Security and Fraud Architect, F5
Artificial Intelligence and Machine Learning (AI/ML) are hot topics these days. They nearly always come up in meetings (whether virtual or in-person) with customers, partners, industry analysts, journalists, and others. Sometimes, the questions and discussions are very focused and specific. But other times, they are quite unfocused and generic.
When I get general questions around AI/ML, I take perhaps a different approach to answering them than others. To me, AI/ML aren’t generic solutions but tools that need to be applied to specific problems in order for them to be effective.
So, what are some problems that enterprises struggle with that AI/ML can help solve? While not an exhaustive list, here are a few of my favourites:
Automated attacks
Automated attacks are often perpetrated by networks of bots. These attacks introduce a number of different risks into enterprises, including fraud losses, inventory manipulation, reputation damage, data theft, infrastructure costs, performance costs, and support costs, among others. Detecting and mitigating automated attacks involves understanding the difference between human and automated traffic.
While this may sound simple conceptually, in practice it is a difficult undertaking that requires a variety of different techniques. One of these techniques is the use of AI/ML – not generally of course, but instead, applied very specifically to the problem of separating unwanted automated traffic from legitimate human traffic.
Fraud
Fraud is a growing problem for enterprises, and in particular, for those enterprises that transact heavily online. Enterprises can suffer fraud losses in many ways, though two forms of fraud that heavily impact the digital channel are Account Takeover (ATO) and Account Opening (AO) fraud. ATO most often involves a fraudster or other unauthorized user taking over an account using compromised credentials, man-in-the-browser (MITB), social engineering, or some other means. AO involves a fraudster or other unauthorized user opening an account using stolen or synthesized Personally Identifiable Information (PII).
Reliably detecting fraud without generating a large number of false positives requires more than rule-based and signature-based fraud detection. It requires understanding the intent of the end-user in the session as they interact with the online application. This entails observing and applying AI/ML to analyze the end-user’s behavior, their device characteristics, and the network/environment they are connecting from. This is another very specific application of AI/ML that has seen good results in practice.
API security
API security is another area where AI/ML can be applied to solve challenging problems. Enterprises have needed to push forward technologically in order to keep up with rapidly evolving market demands. This has entailed pushing out customer-facing applications and APIs to meet end-user demands. In some cases, these applications and APIs are not adequately secured and protected before being released. In other cases, they are not properly inventoried and managed.
All of these introduce vulnerabilities and weaknesses into applications and APIs. This is where discovery powered by AI/ML becomes of great importance to enterprises. Discovery can identify unknown, non-inventoried, and/or unmanaged APIs. It can ensure that APIs are protected by the right type of authentication. Discovery can verify that there is no sensitive data inside requests and responses. And it can ensure that there are no vulnerabilities that need to be remediated. All of these are specific applications of AI/ML that help enterprises increase the security of their applications and APIs.
Conclusion
When people ask me broad, general questions about AI/ML, I tend to focus the discussion a bit. To me, AI/ML is a tool that can and should be applied to specific security and fraud problems that it can help solve. Indeed, there are several important problems that nearly every enterprise encounters that AI/ML have been shown to lend a unique advantage to.
