Given an OT network dealing with critical infrastructure, what ML / “AI” tools would you trust to learn what normal is and alert on not normal?
These would be highly deterministic traffic (nobody surfing the web from here), likely un-encrypted (so deep inspection can be a thing).
There’s lots of vendors hawking stuff that’s basically just “send all your data and we’ll run it through an OpenAI fork”. But this is critical infrastructure and I don’t have time for hallucinations.
Suggestions?
The first things that come to mind are AC Hunter, and RITA which is the Zeek parser that undergirds it.
https://www.activecountermeasures.com/ac-hunter/
https://www.activecountermeasures.com/free-tools/rita/
Rita uses proper ML to identify likely beacons on your network. The AC Hunter interface is a little wacky, but if you have the ability to capture Zeek data, these are worth considering.
It is not terribly difficult to build your own. I have built a number of agents that monitor HTTP traffic (I’m an appsec guy) and then use a model to determine if they are out of spec. Even the vendors who are pimping AI solutions still depend on heavily deterministic code for data processing what not before prompting a model. I am not sure there is really anyone using actual machine learning real time to do that work, it would be shockingly expensive, and not reliable due to its nondeterministic nature.
Not sure I agree. See above for an example of real, realtime ML. Also most “traditional” user behavior analytics engines do the same sort of thing. See Splunk or Elastic.
Regression or cluster algorithms for classification/prediction are fairly deterministic, and once the model is trained, a classification decision is predictable. And these jobs are much cheaper than generative AI inference.
The problem is, you need a lot of time and volume to properly fit the models, and care and feeding of them requires some expertise. Most orgs would rather ask the expedient, if unreliable, generative answer box.