We’ve all heard the buzzwords – artificial intelligence, machine learning, supervised and unsupervised neural networks, etc. – flying around the tech industry. In the world of IT, there’s never a shortage of these buzzwords, but they’re oftentimes used incorrectly and interchangeably.
Many people understand the concept of AI and even machine learning, but since we announced ThreatWarrior™, people often ask us “What is an unsupervised neural network?” This blog post is an attempt to explain what they are and how they operate. It’s oversimplified, but should help you come away with a basic understanding of how unsupervised neural nets work and why they’re useful.
Human vs. Machine Neural Networks
Modern AI is almost as smart as a toddler, so the best way to grasp how it works is to think back to your early childhood. When you were very young, you didn’t know what a dog was. Now consider being asked the following questions today:
- When did you first see a dog?
- What time of day was it?
- How old were you?
- What did you have for dinner that day?
- What were you wearing?
You probably don’t recall the answers to all these questions, but you now know a dog when you see one. At the time you first learned to identify them and for a short time afterwards, you could have answered these questions because you still retained all that information. But over time the details in your memories fade away, and all you retain is the knowledge you learned from the experience.
Learning machines operate the same way. First they go through a training mode, where observations are turned into memories, connections are made between them, and learning occurs. Then the memories fade away, and they go into an inference mode, where the knowledge they’ve gained is used to make immediate decisions based upon the instincts they developed during training.
While CPUs are good for inferring, learning can be a slow process. That’s why we need to apply significantly more processing power. For this, it’s best to use Graphic Processing Units (GPUs) that are highly optimized for raw mathematical computation. Machines develop instincts on GPUs, and then apply what they observe on CPUs.
Our brains are incredibly complex biological computers, and we’re still discovering how they operate. One thing we know is that we have billions of interconnected cells in our brains called neurons, and they enable us to learn and think.
Machine neural networks are rough copies of the ones we see in nature. While a child’s brain is a sponge that soaks up knowledge constantly from all the body’s senses, machines aren’t so flexible. To train a machine neural network, there are two main approaches: supervised and unsupervised learning.
Supervised learning is what most people mean when they talk about machine learning. One area where supervised learning is widely used is image classification – having the machine describe the objects that appear in an image. You can supervise the training of a neural network for image classification by giving it lots of photos and telling it which objects are in each one. For example, after seeing thousands and thousands of labelled examples of dogs and cats, the machine learns what makes a picture of a cat different from a picture of a dog. It can generalize from what it learns. Once it’s trained, you can feed it new photos without any labels, and it can still tell you when it finds a cat or a dog.
This is similar to a process everyone goes through as a small child. Adult supervision provides insight and wisdom to guide you as you observe and learn from the world. After that first time you saw a dog, there was a period of time during which you would point at furry moving objects and say, “Doggie!” Sometimes you’d be right, and you’d be told, “Yes, that is a doggie, good job!” At other times you’d be wrong, and someone would say, “No honey, that’s a kitty-cat.” Over time you’d get better at correctly identifying animals and no longer need an adult’s help.
This is the basic concept of supervised learning.
We know the right answers, and the machine will make predictions on the training data it has access too. If it is wrong, the “supervisor” will correct it so it learns the right answer. If it is right, it will be reinforced to learn that it is getting the right answer.
Unsupervised learning means you’re only exposing a machine to input data. There is no corresponding output data to teach the system the answers it should be arriving at.
With unsupervised learning, you train the machine with unlabeled data that offers it no hints about what it’s seeing. Because it doesn’t know which pictures show cats and which show dogs, it can’t learn how to tell them apart. Instead, it can learn the similarities between all the pictures you expose it to. That doesn’t help with classifying images (this neural network will never tell you when a picture contains a dog or a cat). But it is helpful for lots of other tasks. It can let you know when a new picture is so different from what it’s previously been exposed to that it’s confident the picture contains neither dogs nor cats. It can take large images of cats or dogs and distill them down to lists of characteristics (like ‘pointy ears’ or ‘soft’) that take up less space for storage, and then expand them out to pictures again. It can even dream up new images of cats or dogs.
Unsupervised learning can be compared to the way children learn about the world without the insights of adult supervision. No one teaches children to be surprised and curious about a species of animal they’ve never seen before. No one needs to teach children to associate a quality like softness with an animal’s fur, only how to articulate the association they’ve already made themselves from patterns of experience. You may not be able to identify that a child’s finger-painting represents a dog, but they’re still able to draw a picture that, to them, expresses what they’ve learned about how dogs appear.
ThreatWarrior™ and Unsupervised Neural Networks
Supervised learning is great when you have a large, curated library of labeled examples. When you can provide thousands and thousands of examples of what a machine should learn, you can supervise machine learning. However, that’s not always feasible. It can take a long time and a lot of manual labor to build that kind of library. And sometimes problems just aren’t suited to it. That’s when you turn to unsupervised learning. Unsupervised neural networks are particularly useful in areas like digital art and fraud detection.
ThreatWarrior is the first solution to use unsupervised neural networks for cyber defense. We applied unsupervised neural networks because we’re seeking threats for which we have no prior experiences. While we also have supervised neural networks that we utilize for prior lessons learned and experiences we can pass down, many threats don’t have signatures that we can simply recognize. For this, we need the machine to self-learn patterns of behavior, so that it can develop its own instincts.
By learning what’s ‘normal’ for a network, ThreatWarrior also learns what’s abnormal. If there is activity or behaviors that fall outside the learned pattern, ThreatWarrior will alert to these anomalies.
If you have questions or are curious to see how ThreatWarrior can use unsupervised neural networks to protect your organization, please visit our contact page and talk with KineticFuse today.