Yup, while everyone who actually use ML is aware of this, there're too much hypes. Another keyword which shouldn't be missed is 'probability'. No one seems to be able to emphasize enough that ML can never be silver bullet in security and these 'AI's are far from intelligence.
Very interesting article, I now finally understand how AI/ML works, it sure as hell doesn't sound like the silver bullet.
I used to play with AI with the stock market. Don't see any difference with malware. Only as good as what it learns from, which by default is out of date. What is outstanding is the market hype.
Because Cylance got hundreds of millions, simple as that; so all the wannabe millionaires jumped on the boat and start advertising it as the ultimate technology for their own benefits. Big names used the ML/Ai technologies since ages but nobody cared until Cylance funding.
Actually that is true to human malware experts too (and most if not all of other 'proactive' approach such as BB etc.). We can only rely on what we know, however, human experts are flexible/adaptive enough to find completely new malware as he/she can think from a perspective of what is beneficial/harmful to user, to some extent apart from the property of the code. This is a big and real difference. But you made a good point, as it is closely related to overlearning, one of the problems ML users always care. Just as a note, if it was chess or stock prediction, a vast sample set is not always necessary. As there's clear win/lose or correct/incorrect, just give a reward when 'AI' won/were correct and it can learn by itself w/out samples. This is how reinforcement learning including DQN works. However, there's no such clear rule in malware classification and if human wants to give reward/punishment to ML he need to verify the classification, which is not better than giving samples.
Some years ago I coded some forex AI's to trade automatically, I was quite proud of the coding from a technical point of view, well aside from the fact they didn't make me any money, but I think that is because I didn't really understand the market well enough at the time.
Well I used an AI package, and set up some market data using the data, and some indicators which could be used to trade, and trained using about 4 years worth of data. The results over the data set were excellent, but going forwrard the trained results were no better then not using the AI. Looked at some commercial packages that theoretically might have been better. They did make money.... for the people marketing them. No thanks.
@Peter2150 I worked on those trading AI's for some time before I quit messing with it, the reason, I realized the brokers were fixing the data feed. The way they do it is by introducing a delay between when they receive the price quotes and when they broadcast them. They apply algorithms to that data to "adjust it". I proved that by comparing price data I collected from 4 different brokers at the same time, the variations were huge, up to 30 points difference between them. Some used such heavy price smoothing that fluctuations that my AI's would have profited nicely from were smoothed to where they could barely make the spread.
If that is all you did, part of the reason can be lack of parameters in the model rather than overlearning. But even for just a technical analysis than fundamental analysis, I don't expect ML to excel human, considering how many factors affect stock price. As I said in other thread regarding malware analysis, real advantage of ML for such a matter is efficiency and not accuracy. ML may be able to calculate 100s of names within a second, but if it didn't save your time don't use it.
Yup, ideally you need deep knowledge of the phenomenon you want to apply ML to as well as basic math to properly choose/modify an algorithm and/or function, set/constraint parameters, and interpret results (and ofc coding skills to efficiently calculate. but I won't be surprised if these days many ppl just use known library for the matter.) Still it's often not clear which algorithm/function is the best, how many parameter should one use, etc.. While there're some indicator such as AIC and some conventional technique such as penalty rule for additional parameters, there's no absolute way and you have to judge according to the property of the phenomenon, your purpose, and computational resource (again, I won't be surprised if most ppl just use some algo w/out such formal consideration). But it should also be noted even in poker where you can set all important parameter, it's still hard to beat human pro player except veeery limited rule set cases. Almost all media just scoop how 'AI' is great w/out telling backstory. If it was - I think many ppl didn't think Deep Blue 'won' in the chess match.
If you look at the wild swings on the stock markets in especially the USA, I wouldn't be surprised if AI computers are already running the show.
