Mediaboss Marketing

During a brainstorming discussion with a colleague on the value of entropy in machine learning models, specifically the models used in threat intelligence work, I mentioned that many of the threat intelligence models in use today seem to overemphasize the pattern recognition aspect of threat intelligence through the egregious use of algorithms. By contrast, they seem to underemphasize the novelty of suchaspects as intuition and chaos, both of which would be present if two malicious actors were pitted against a defensive system that is nothing more than an artificially intelligent system with lots of machine learning algorithms. Then I thought about the game of chess, which cognitive psychologists have studied with great interest for more than 70 years. I did a bit of my own research to see what aspects of chess psychologists found most intriguing, and whetherany of their findings could be used to build better threat intelligence programs.

The 1965 book Thought and Choice in Chess,by Adriaan D de. Groot, seems to have laid the foundation for the study of psychology in chess. There are several other psychologists who studied the game and its players; William Chase, Herbert Simon and Dr. Ferdinand Gobet are worth mentioning. The short synopsis of their combined research on the best chess players is as follows:

There are many more findings published on the cognitive aspects of chess, but this short list led to something researchers today callChunk Hierarchy and REtrival STructures(CHREST). CHREST,in turn, led to the design of computational models that could help psychologists understand why chess experts are so good at the game, by studying the number of moves the typical chess expert memorizes and how an expertorganizes information mentally while playing. The research into CHREST, in turn, led to the development of mathematical models for hierarchical chunking in the brain to help cognitive scientists understand how the brain ingests, organizes, stores and later retrieves information.

So what does all this research on the game of chess have to do with threat intelligence? A great deal. CHREST and the subsequent mathematical models for hierarchy and retrieval structures underpin the databases, algorithms and artificially intelligent software used for threat hunting and by the threat intelligence correlation engines today (as well as other types of technology).

Threat hunters today are much likeplayers in a game of chess where the adversary maneuvers in much the same ways as an opponent across a grand chess board. A good threat hunter can determine just who that opponent is, based on the moveshe or she makes. We consider adversarial activity as tactics, techniques and procedures just as we consider a chess opponents moves as rooted in strategy where the decisions made are based upon patterns and models. One could easily consider the science of threat intelligence as the identification of these patterns as quickly as possible to predict future action and to engage appropriate response maneuvers. However, where does the science of threat intelligence intersect the art of intuitive prediction based on skilland experience? How can an analyst derive meaning and predictive value in a seemingly chaotic engagement?

Interestingly, one of the experiments with the CHREST model showed that expert chess players havesuperior memory recall for chess positions that are considered random by weaker players. Why is this important? Because it shows that expert players are not only playing the game based upon the patterns they know or the visual representation they have of the chess board in their minds, they are also playing by intuition or gut-feeling something no mathematical model, machine learning algorithm or artificially intelligent system can duplicate today.

By allowing a team of analysts to rely on their expertise with the introduction of chaos and entropy, we can glean the actions and strategic moves that wed the science of threats with the art of analysis. Then we can truly provide a robust threat intelligence gathering effort that provides threat actor identification, activity prediction, mitigation and response strategies.

To harness the threat intelligence power enabled by chaos and entropy, we can take the followinglessons from the game of chess:

All of this analysis sounds glorious for large firms with lots of available capital. For small businesses with limited access to both financial and human capital, building a sophisticated threat intelligence team is extremely difficult to achieve.Small businesses:

What could a small business or firm do with a limited budget and no sophisticated COTS solution? Itcan hire entry-level cyber security professionals who have a love for the game of chess, because those individuals will bring with them the following capabilities:

Skills such as those needed to findOWASP Top 10 vulnerabilities within an application stack can be taught through suchsites as HackerOne. The best hackers we have ever met had something in common with the best chess players we know a love for the game.

Continue Reading

Management and Strategy Consultant, IBM

Kelly is a management and strategy consultant with over 20 years of consulting experience ranging from security analysis, to functional analysis to security ... read more

Read this article:
A Grand Game of Chess: Entropy and Patterns in Threat Intelligence Models - Security Intelligence