Automation for information security using machine learning

Many tasks in information security require data analysis to ensure the security of information and information systems. The amount of data that a security officer typically needs to analyze is large, which makes the automation of such analysis highly desirable. One way to achieve such automation of security tasks is by using machine learning. Machine learning techniques aim to solve tasks by learning a model from data, thereby drastically reducing the need for human labor. However, to apply machine learning on information security tasks a number of challenges need to be addressed. Currently, research on information security concerning machine learning focuses mainly on two areas: the application of machine learning to solve particular security tasks, and the design of secure machine learning algorithms. In this work, we focus on three challenges that are crucial for the application of machine learning in information security: the lack of supervision, the integration of domain knowledge and the lack of contextual information. To address them, we select two specific tasks from two use cases, one from forensic log analysis and one from intrusion detection, in particular, data leakage detection. To address these challenges, we propose the following: a method for signature extraction from forensic logs to verify our assumption that deep learning models are well-suited for capturing the structure of such logs; an unsupervised method for clustering forensic logs to address the lack of supervision; a method for integrating domain knowledge in the machine learning process; and a method that can create believable project decoys in a data-driven way that could be used for obtaining the lacking contextual information. In this thesis, we empirically show the following: i) deep learning models are well-suited for modeling semi-structured forensic logs, hence can be used for signature extraction better than the state-of-the-art ii) deep learning models can outperform state-of-the-art methods for clustering forensic logs in an unsupervised way, which means that we can address such a problem without using labels iii) we can use domain knowledge to improve the learning of deep learning models for the clustering of forensic logs and iv) Markov Chains can be automated to generate believable project decoys in a data-driven way. The proposed methods demonstrate ways to address the lack of supervision, the integration of domain knowledge, and the lack of contextual information. Addressing these challenges leads to the advancement of automation for information security when using machine learning. Apart from that, we believe that a similar, machine learning based methods can be applied to other data theft scenarios, with different types of decoy objects. Furthermore, we believe that similar DL-based methods as the ones proposed in this thesis could be applied to automate other tasks with similar challenges, for example, malware analysis or the detection of phishing attacks.