Machine learning helps cybersecurity teams process logs and detect threats faster, but it still depends on expert knowledge and cannot replace experienced analysts.
2
Cybersecurity teams use machine learning for anomaly detection, known attack behavior, fake-news analysis, open source intelligence, and real-time monitoring of critical systems.
3
Sensitive data and security constraints can require distributed architectures that analyze information on each machine instead of moving it to a central location.
Summary
Monika Venčkauskaitė explains how machine learning is used in cybersecurity and where it falls short. She describes the incident-response cycle, from identifying a threat through protection, detection, response, and recovery. Machine learning agents can inspect logs faster than people, detect anomalies, and match behavior to known attack patterns, though experts are still needed to provide training data and spot blind spots. The talk also covers fake news, attacks on machine learning systems, autonomous vehicles, hospital systems, power plants, and open source intelligence. Open source intelligence tools gather public information, analyze images and text, and map connections between people and organizations. Monika describes a distributed cybersecurity system built for customers who could not move sensitive data to a central location. The result is a practical account of why cybersecurity needs real-time analysis, specialist judgment, and careful control over data access.
Cybersecurity incident response follows a cycle that machine learning can speed up
Monika describes five stages of incident response: identification, protection, detection, response, and recovery. Teams identify threats through system logs and tools such as Suricata and Zeek. Protection includes access controls, limited permissions, staff training, and information protection. During detection, machine learning agents can inspect logs and classify attacks faster than a human analyst. The system still needs expert-provided examples of how attacks appear in data. Response must happen quickly when an account is compromised or a service faces denial of service. Recovery includes restoring the service, communicating during the incident, and fixing the vulnerability.
Anomaly detection can find new attacks, while behavior models recognize known patterns
In response to Demetrios Brinkmann's question about new attacks, Monika distinguishes two approaches. An anomaly detector looks for unusual network patterns or unexpected logging, which can reveal an attack type absent from the training data. Another model looks for behavior it has seen before, such as someone logging in and trying to gain root privileges. An advanced system can combine both methods. Monika says machine learning systems still have blind spots, so experienced cybersecurity specialists must work alongside them. The practical role of ML is to automate regular detection tasks and make experts faster.
The shortage of cybersecurity specialists makes automation necessary
Monika says cybersecurity already has a shortage of about four million experts worldwide. Existing specialists therefore need tools that reduce repetitive work and help them respond faster. She presents machine learning as a way to reduce the pressure caused by the shortage, while still requiring people who understand malicious behavior and the limits of the models. She also describes cybersecurity as a growing career area. People can enter through analyst work, where they inspect logs and identify hacker patterns, or through product development, supported by coding skills, online courses, and industry certificates.
Machine learning creates new security risks while helping detect them
Monika points out that machine learning can make fake news and fake videos easier to produce, while similar algorithms can help detect them. Systems might examine differences in comments and sentiment because coordinated fake-news campaigns often try to provoke strong reactions. Machine learning systems themselves can also be attacked. She gives face recognition as an example, explaining that masks and other methods can fool some systems. Automated defense systems use machine learning to select targets, much like recommendation engines select products. These examples show that ML is part of both the attack surface and the defense.
Open source intelligence combines web collection with machine learning
Open source intelligence tools collect information from public profiles, chats, social networks, posts, and images. Monika worked on a system that used machine learning for object recognition in photos and sentiment analysis in text. The system treats a person, company, university, organization, or activist group as an entity and builds information about it over time. Crawlers gather new data regularly, while graph representations show connections between entities and topics. This can expose coordinated campaigns, such as groups spreading fake news. Monika says the volume is beyond what one person can analyze, which is where statistical methods and machine learning help.
Open source intelligence requires permissions because the data is sensitive
The information collected by open source intelligence systems can include locations attached to photos and relationships between people. Monika says access is limited for safety reasons and may require special permissions or agreements with social media platforms. She describes governments using these tools to track activity on the internet, including possible coordinated campaigns and military equipment. Demetrios Brinkmann raises the risk of government abuse. Monika says social networks have added controls against scraping and bots, although no system can make data completely safe because attackers also improve their methods.
Real-time agents monitor systems where delayed detection can affect physical safety
Machine learning agents can receive streamed data from autonomous cars, power plants, nuclear power plants, laptops, and communication satellites. They analyze the data in real time and alert human operators. Monika says people usually still decide what action to take, although she speculates that future systems closer to artificial general intelligence could make those decisions themselves. She stresses that these tools protect systems that affect communication, transport, electricity, and other parts of daily life. Power-plant security is a separate area because teams must understand how those systems operate before they can detect malicious activity.
Sensitive data can require a distributed cybersecurity architecture
Monika describes a distributed machine learning cybersecurity system built with agents on each node, meaning each computer in the system. The customers did not want their data transferred to a central location because of safety requirements. The system therefore analyzed data separately on each node instead of collecting it in one place. This architecture lets the system inspect local information while respecting the customer's restriction on data movement. Monika presents it as an example of how cybersecurity requirements shape the design of machine learning systems.
"Cyber security is going to be more important in the future and machine learning also can be hacked in very unpredictable ways."Monika Venčkauskaitė24:45
Who should watch
You are building detection systems and need to decide where anomaly detection, known-behavior models, and human analysts fit.
You work with cybersecurity data that cannot be moved to a central service and want an example of a distributed ML design.
You are considering a career in cybersecurity and want to compare analyst work with machine learning product development.
