{"id":8666,"date":"2019-05-20T03:45:33","date_gmt":"2019-05-20T03:45:33","guid":{"rendered":"https:\/\/nsfocusglobal.com\/?p=8666"},"modified":"2026-04-17T18:07:53","modified_gmt":"2026-04-17T18:07:53","slug":"practices-of-chinas-internet-giants-in-machine-learning","status":"publish","type":"post","link":"https:\/\/nsfocusglobal.com\/pt-br\/practices-of-chinas-internet-giants-in-machine-learning\/","title":{"rendered":"Practices of China’s Internet Giants in Machine Learning"},"content":{"rendered":"


\n<\/p>\n

At RSA Conference 2019, Tao Zhou, a senior staff algorithm engineer from Alibaba Security, Alibaba Group, as one of only a few Chinese speakers, started his presentation on application of statistical learning to intrusion detection in the context of massive big data with an account of challenges facing Internet giants in security data analysis, and then shared his constructive ideas on this topic.<\/p>\n

For starters, Tao Zhou pointed out that in security defense and attack, the biggest advantage defenders have lies in massive data of various types.<\/p>\n

However, data is a double-edged sword. How to put massive data into good use is a common question baffling defenders in the era of big data.<\/p>\n

\"Red<\/a><\/p>\n

Massive data is far beyond the human capacity to process. Therefore, it is high time for computers to step in, relieving people of the burden of complex computation with various algorithm models, as represented by machine learning and statistical modeling.<\/p>\n

Tao Zhou thinks that the most distinctive difference between the two models is that machine learning relies on training data (preferably labeled data), but statistical modeling relies on human’s understanding of data traits.<\/p>\n

\"Red<\/a> \"Red<\/a><\/p>\n

Machine learning, when applied as the only approach to intrusion detection, would encounter a lot of problems because machine learning is good at detecting “normal patterns”, but intrusion is abnormal behavior. Moreover, for supervised learning, machine learning algorithms need large amounts of labeled data, which are hard to obtain. For unsupervised learning, currently the accuracy and recall rate of almost all related algorithms cannot support security operations. Finally, the biggest problem of machine learning is that the classification model built on data training is usually too complex to interpret. The simple answer of “Yes” or “No” is insufficient for security analysis.<\/p>\n

Therefore, when applying machine learning to intrusion detection, we usually need to specify certain scenarios, typically those where labeled data is easy to obtain, like spam detection, DGA domain detection, and web crawler detection.<\/p>\n

\"Red<\/a><\/p>\n

Tao Zhou then went further to illustrate the common process of applying statistical modeling to intrusion data analysis. First, he pointed out that, effective attacks always take a long process, generally spanning a long time period with multiple stages and originated from multiple nodes.<\/p>\n

\"Red<\/a><\/p>\n

Security data analysis consists of three steps:\n<\/p>\n