VentureBeat made with DALL-E
Capturing weak signals across endpoints and predicting potential intrusion attempt patterns is a perfect challenge for Large Language Models (LLMs) to take on. The goal is to mine attack data to find new threat patterns and correlations while fine-tuning LLMs and models. Leading endpoint detection and response (EDR) and extended detection and response (XDR) vendors are taking on the challenge.
Nikesh Arora, Palo Alto Networks chairman and CEO, said, “We collect the most amount of endpoint data in the industry from our XDR. We collect almost 200 megabytes per endpoint, which is, in many cases, 10 to 20 times more than most of the industry participants. Why do you do that? ….….Story continues..
By: Louis Columbus
Source: Why training LLMs with endpoint data will strengthen cybersecurity | VentureBeat
.
Critics:
A backdoor in a computer system, a cryptosystem, or an algorithm, is any secret method of bypassing normal authentication or security controls. These weaknesses may exist for many reasons, including original design or poor configuration. Due to the nature of backdoors, they are of greater concern to companies and databases as opposed to individuals.
Backdoors may be added by an authorized party to allow some legitimate access, or by an attacker for malicious reasons. Criminals often use malware to install backdoors, giving them remote administrative access to a system. Once they have access, cybercriminals can “modify files, steal personal information, install unwanted software, and even take control of the entire computer.”
Backdoors can be very hard to detect, and are usually discovered by someone who has access to the application source code or intimate knowledge of the operating system of the computer. Denial of service attacks (DoS) are designed to make a machine or network resource unavailable to its intended users.
Attackers can deny service to individual victims, such as by deliberately entering a wrong password enough consecutive times to cause the victim’s account to be locked, or they may overload the capabilities of a machine or network and block all users at once. While a network attack from a single IP address can be blocked by adding a new firewall rule, many forms of Distributed denial of service (DDoS) attacks are possible, where the attack comes from a large number of points.
In this case defending against these attacks is much more difficult. Such attacks can originate from the zombie computers of a botnet or from a range of other possible techniques, including distributed reflective denial of service (DRDoS), where innocent systems are fooled into sending traffic to the victim.
With such attacks, the amplification factor makes the attack easier for the attacker because they have to use little bandwidth themselves. To understand why attackers may carry out these attacks, see the ‘attacker motivation’ section. A direct-access attack is when an unauthorized user (an attacker) gains physical access to a computer, most likely to directly copy data from it or to steal information.
Attackers may also compromise security by making operating system modifications, installing software worms, keyloggers, covert listening devices or using wireless microphones. Even when the system is protected by standard security measures, these may be bypassed by booting another operating system or tool from a CD-ROM or other bootable media. Disk encryption and Trusted Platform Module are designed to prevent these attacks.
Direct service attackers are related in concept to direct memory attacks that allows an attacker to gain direct access to a computer’s memory. The attacks “take advantage of a feature of modern computers that allow certain devices, such as external hard drives, graphics cards or network cards, to access the computer’s memory directly.”
To help prevent these attacks, computer users must ensure that they have a strong passwords, that their computer is locked at all times when they are not using it, and that they keep their computer with them at all times when traveling. Eavesdropping is the act of surreptitiously listening to a private computer conversation (communication), usually between hosts on a network.
It typically occurs when a user connects to a network where traffic is not secured or encrypted and sends sensitive business data to a colleague, which when listened to by an attacker could be exploited. Data transmitted across an “open network” allows an attacker to exploit a vulnerability and intercept it via various methods.
Unlike malware, direct-access attacks, or other forms of cyber attacks, eavesdropping attacks are unlikely to negatively affect the performance of networks or devices, making them difficult to notice.In fact, “the attacker does not need to have any ongoing connection to the software at all. The attacker can insert the software onto a compromised device, perhaps by direct insertion or perhaps by a virus or other malware, and then come back some time later to retrieve any data that is found or trigger the software to send the data at some determined time.”
Using a virtual private network (VPN), which encrypts data between two points, is one of the most common forms of protection against eavesdropping. Using the best form of encryption possible for wireless networks is best practice, as well as using HTTPS instead of an unencrypted HTTP.
Programs such as Carnivore and NarusInSight have been used by the Federal Bureau of Investigation (FBI) and NSA to eavesdrop on the systems of internet service providers. Even machines that operate as a closed system (i.e., with no contact with the outside world) can be eavesdropped upon by monitoring the faint electromagnetic transmissions generated by the hardware. TEMPEST is a specification by the NSA referring to these attacks.
Malicious software (malware) is any software code or computer program “intentionally written to harm a computer system or its users.” Once present on a computer, it can leak sensitive details such as personal information, business information and passwords, can give control of the system to the attacker, and can corrupt or delete data permanently.
Another type of malware is ransomware, which is when “malware installs itself onto a victim’s machine, encrypts their files, and then turns around and demands a ransom (usually in Bitcoin) to return that data to the user.
Surfacing in 2017, a new class of multi-vector, polymorphic cyber threats combine several types of attacks and change form to avoid cybersecurity controls as they spread. Multi-vector polymorphic attacks, as the name describes, are both multi-vectored and polymorphic. Firstly, they are a singular attack that involves multiple methods of attack.
In this sense, they are “multi-vectored (i.e. the attack can use multiple means of propagation such as via the Web, email and applications.” However, they are also multi-staged, meaning that “they can infiltrate networks and move laterally inside the network. The attacks can be polymorphic, meaning that the cyberattacks used such as viruses, worms or trojans “constantly change (“morph”) making it nearly impossible to detect them using signature-based defences.
Leave a Reply