We’ve all heard the buzzwords – artificial intelligence, machine learning, supervised and unsupervised neural networks, network detection and response, etc. – flying around the tech industry. In the world of IT, there’s never a shortage of these buzzwords, but they’re oftentimes used incorrectly and interchangeably.
Many people understand the concept of AI and even machine learning, but people often ask us, “What is an unsupervised neural network?” While oversimplified, this blog should help you come away with a basic understanding of how unsupervised neural nets work and why they’re useful.
AI vs. Machine Learning vs. Deep Learning
To start, we need to distinguish the difference between all the terms you may have heard.
Artificial intelligence is a very broad term. Any technology that enables computers to mimic human intelligence could technically qualify as AI. However, there are huge differences in the power, capabilities, and applications of AI.
Machine learning is all about extracting valuable information from data, enabling machines to learn by experience. This means the machine learns to identify objects or patterns without having to be told what to look for. Machine learning addresses cases where it’s infeasible to develop an algorithm or specific instructions for performing a task.
Deep learning is a powerful subfield of machine learning. It’s all about using neural networks to process information the same way the human brain does. Neural networks are inspired by the connections in the brain and how organic neurons distribute information. It’s called deep learning because of the layered structure of these neural networks; as you go deeper, more complex features are extracted and modeled.
Additionally, you can break deep learning down by whether it uses supervised or unsupervised neural networks. Supervised learning works great when you have a large, curated library of labeled examples. When you can provide thousands upon thousands of examples of what a machine should learn, you can supervise machine learning. However, that’s not always feasible. It can take a long time and a lot of manual labor to build that kind of library. Plus, sometimes problems just aren’t suited to it. That’s when you turn to unsupervised learning.
Human vs. Machine Neural Networks
Modern AI is almost as smart as a toddler, so the best way to grasp how it works is to think back to your early childhood. When you were very young, you didn’t know what a dog was. Now consider being asked the following questions today:
- When did you first see a dog?
- What time of day was it?
- How old were you?
- What did you have for dinner that day?
- What were you wearing?
You probably don’t recall the answers to all these questions, but you now know a dog when you see one. At the time you first learned to identify them and for a short time afterward, you could have answered these questions because you still retained all that information. But over time the details in your memories fade away, and all you retain is the knowledge you learned from the experience.
Learning machines operate the same way. First, they go through a training mode, where observations are turned into memories, connections are made between them, and learning occurs. Then the memories fade away, and they go into an inference mode, where the knowledge they’ve gained is used to make immediate decisions based upon the instincts they developed during training.
While CPUs are good for inferring, learning can be a slow process. That’s why we need to apply significantly more processing power. For this, it’s best to use Graphics Processing Units (GPUs) that are highly optimized for raw mathematical computation. Machines develop instincts on GPUs and then apply what they observe on CPUs.
Our brains are incredibly complex biological computers, and we’re still discovering how they operate. One thing we know is that we have billions of interconnected cells in our brains called neurons, and they enable us to learn and think.
Machine neural networks are rough copies of the ones we see in nature. While a child’s brain is a sponge that soaks up knowledge constantly from all the body’s senses, machines aren’t so flexible. To train a machine neural network, there are two main approaches: supervised and unsupervised learning.
Supervised Learning
Supervised learning is what most people mean when they talk about machine learning. One area where supervised learning is widely used is image classification – having the machine describe the objects that appear in an image. You can supervise the training of a neural network for image classification by giving it lots of photos and telling it which objects are in each one. For example, after seeing thousands and thousands of labeled examples of dogs and cats, the machine learns what makes a picture of a cat different from a picture of a dog. It can generalize from what it learns. Once it’s trained, you can feed it new photos without any labels, and it can still tell you when it finds a cat or a dog.
This is similar to a process everyone goes through as a small child. Adult supervision provides insight and wisdom to guide you as you observe and learn from the world. After the first time you saw a dog, there was a period of time during which you would point at furry moving objects and say, “Doggie!” Sometimes you’d be right, and you’d be told, “Yes, that is a doggie, good job!” At other times you’d be wrong, and someone would say, “No honey, that’s a kitty-cat.” Over time you’d get better at correctly identifying animals and no longer need an adult’s help.
This is the basic concept of supervised learning.
We know the right answers, and the machine will make predictions on the training data it has access too. If it is wrong, the “supervisor” will correct it so it learns the right answer. If it is right, it will be reinforced to learn that it is getting the right answer.
However, if a solution relies solely on supervised machine learning and requires a human to teach it what to look for, it inherently introduces human bias. In cybersecurity, this can lead to myriad false alarms, or worse, completely missing a dangerous threat.
Unsupervised Learning
Unsupervised learning means you’re only exposing a machine to input data. There is no corresponding output data to teach the system the answers it should be arriving at.
With unsupervised learning, you train the machine with unlabeled data that offers it no hints about what it’s seeing. Because it doesn’t know which pictures show cats and which show dogs, it can’t learn how to tell them apart. Instead, it can learn the similarities between all the pictures you expose it to. That doesn’t help with classifying images (this neural network will never tell you when a picture contains a dog or a cat). But it is helpful for lots of other tasks. It can let you know when a new picture is so different from what it’s previously been exposed to that it’s confident the picture contains neither dogs nor cats. It can take large images of cats or dogs and distill them down to lists of characteristics (like ‘pointy ears’ or ‘soft’) that take up less space for storage, and then expand them out to pictures again. It can even dream up new images of cats or dogs.
Unsupervised learning can be compared to the way children learn about the world without the insights of adult supervision. No one teaches children to be surprised and curious about a species of animal they’ve never seen before. No one needs to teach children to associate a quality like softness with an animal’s fur, only how to articulate the association they’ve already made themselves from patterns of experience. You may not be able to identify that a child’s finger-painting represents a dog, but they’re still able to draw a picture that, to them, expresses what they’ve learned about how dogs appear.
ThreatWarrior™ and Unsupervised Neural Networks
Supervised learning is great when you have a large, curated library of labeled examples. When you can provide thousands and thousands of examples of what a machine should learn, you can supervise machine learning. However, that’s not always feasible. It can take a long time and a lot of manual labor to build that kind of library. And sometimes problems just aren’t suited to it. That’s when you turn to unsupervised learning. Unsupervised neural networks are particularly useful in areas like digital art, fraud detection and cybersecurity.
ThreatWarrior is the first solution to use unsupervised neural networks for cyber defense. We applied unsupervised neural networks because we’re seeking threats for which we have no prior experiences. While we also have supervised neural networks that we utilize for prior lessons learned and experiences we can pass down (our customers provide the supervision through human oversight in their environments), many threats don’t have signatures that we can simply recognize. For this, we need the machine to self-learn patterns of behavior, so that it can develop its own instincts.
By learning what’s ‘normal’ for a network, ThreatWarrior also learns what’s abnormal. If there is activity or behaviors that fall outside the learned pattern, ThreatWarrior will alert to these anomalies.
Another big advantage of neural networks is that they excel at feature extraction: building complex hierarchies of meaning to express information from raw data.
Apply this to cybersecurity, and you can derive information from raw traffic like, “who talked to whom about what” to conceptualize higher-order patterns in the environment. Using unsupervised neural networks to perform deep learning allows you to observe significantly more detail, so what you see is a better, more accurate picture of your security environment.
Antiquated solutions can require manual work for programmers to codify examples of what’s normal into their platforms, taking up valuable time and resources. ThreatWarrior does this without any supervision and with no feature engineering, meaning our solution is trained uniquely on your network data.
If you have questions or are curious to see how ThreatWarrior can use unsupervised neural networks to protect your organization, please visit our contact page and talk with ThreatWarrior today.
