許多網(wǎng)絡(luò)安全公司表示,人工智能可以更好地打擊網(wǎng)絡(luò)釣魚(yú),即一種常見(jiàn)的黑客攻擊手段。
Tessian就是一家這樣的公司,其在5月25日表示,它在C輪融資中籌集了6500萬(wàn)美元,目前公司的估值已經(jīng)達(dá)到5億美元。這輪融資由March Capital領(lǐng)投,參投方包括Accel、Balderton Capital、Latitude Venture Partners、紅杉資本(Sequoia Capital)和Schroder Adveq。自八年前成立以來(lái),Tessian共籌集了總計(jì)1.37億美元的資金。
在網(wǎng)絡(luò)釣魚(yú)攻擊過(guò)程中,犯罪分子會(huì)誘騙不知情的員工點(diǎn)擊看似來(lái)源合法的電子郵件里的惡意鏈接。一些最常見(jiàn)的網(wǎng)絡(luò)釣魚(yú)手段則是黑客以銀行或同事的名義發(fā)送欺騙性垃圾郵件。
這類(lèi)黑客攻擊手段在新冠疫情期間尤為普遍,騙子向人們大量發(fā)送聲稱(chēng)來(lái)自于美國(guó)疾病控制與預(yù)防中心(Centers for Disease Control and Prevention)以及其它應(yīng)對(duì)全國(guó)性疫情的相關(guān)組織的欺騙性信息。
IronScales和Vade Secure等數(shù)家網(wǎng)絡(luò)安全初創(chuàng)公司正在借助機(jī)器學(xué)習(xí)來(lái)識(shí)別釣魚(yú)郵件。風(fēng)險(xiǎn)投資者認(rèn)為,這些初創(chuàng)企業(yè)有望成為大型企業(yè)。
Tessian的聯(lián)合創(chuàng)始人及首席執(zhí)行官蒂姆?薩德勒表示,為了建立相關(guān)模型,他們會(huì)先收集分析公司的電子郵件數(shù)據(jù),比如員工用于聯(lián)系客戶的常用郵箱地址。然后,他們會(huì)使用這些數(shù)據(jù)來(lái)訓(xùn)練機(jī)器學(xué)習(xí)模型,該模型能夠在員工點(diǎn)開(kāi)新的電子郵件前事先掃描它們并標(biāo)記出可疑郵件。
機(jī)器學(xué)習(xí)系統(tǒng)還會(huì)闡述懷疑原因,例如電子郵件中附有一條陌生網(wǎng)絡(luò)鏈接或員工姓名拼寫(xiě)錯(cuò)誤。Tessian的聯(lián)合創(chuàng)始人及首席技術(shù)官埃德?畢曉普解釋說(shuō),如果員工們通常叫經(jīng)理Cliff,但某封電子郵件稱(chēng)其為Clifton, 那么Tessian的技術(shù)可能就會(huì)識(shí)別出這種異常。
薩德勒承認(rèn),“機(jī)器學(xué)習(xí)系統(tǒng)仍然存在許多缺陷”,有時(shí)候該公司的人工智能會(huì)將合法郵件錯(cuò)誤標(biāo)記為欺詐郵件。但他表示,Tessian一直在努力避免該軟件錯(cuò)誤標(biāo)記真實(shí)郵件的次數(shù)過(guò)多。
薩德勒說(shuō),總部位于倫敦的Tessian計(jì)劃將一部分最新融資用于招聘,爭(zhēng)取將員工人數(shù)從170人增加到220人,再到今年年底的250人。該公司還計(jì)劃改進(jìn)其技術(shù),擴(kuò)大識(shí)別范圍到其它通信服務(wù)領(lǐng)域(比如短信或辦公聊天軟件)的網(wǎng)絡(luò)釣魚(yú)攻擊。
試圖打擊網(wǎng)絡(luò)釣魚(yú)的公司所面臨的一大挑戰(zhàn)是,隨著自然語(yǔ)言處理技術(shù)的發(fā)展,釣魚(yú)郵件越來(lái)越像真實(shí)郵件了。自然語(yǔ)言處理是人工智能的一個(gè)子領(lǐng)域,是指機(jī)器理解并解釋人類(lèi)寫(xiě)作、說(shuō)話方式的能力。畢曉普表示,隨著優(yōu)秀的語(yǔ)言模型的進(jìn)步,例如由人工智能公司OpenAI訓(xùn)練與開(kāi)發(fā)的GPT-3模型(Generative Pretrained Transformer-3,第三代生成式預(yù)訓(xùn)練轉(zhuǎn)換器——譯注),犯罪分子打造針對(duì)特定收件人的個(gè)性化釣魚(yú)郵件時(shí)的難度會(huì)變得更低。比如,這樣的電子郵件可能會(huì)包含人工智能生成的信息,其寫(xiě)作風(fēng)格類(lèi)似于員工老板,導(dǎo)致辨別真假的難度更高。
因此,Tessian以及其它公司都在盡力改進(jìn)他們的人工智能,以識(shí)別出由更先進(jìn)的人工智能支撐的網(wǎng)絡(luò)釣魚(yú)攻擊,這種攻擊有朝一日可能會(huì)“像垃圾郵件一樣普遍”,畢曉普說(shuō)。(財(cái)富中文網(wǎng))
譯者:Claire
許多網(wǎng)絡(luò)安全公司表示,人工智能可以更好地打擊網(wǎng)絡(luò)釣魚(yú),即一種常見(jiàn)的黑客攻擊手段。
Tessian就是一家這樣的公司,其在5月25日表示,它在C輪融資中籌集了6500萬(wàn)美元,目前公司的估值已經(jīng)達(dá)到5億美元。這輪融資由March Capital領(lǐng)投,參投方包括Accel、Balderton Capital、Latitude Venture Partners、紅杉資本(Sequoia Capital)和Schroder Adveq。自八年前成立以來(lái),Tessian共籌集了總計(jì)1.37億美元的資金。
在網(wǎng)絡(luò)釣魚(yú)攻擊過(guò)程中,犯罪分子會(huì)誘騙不知情的員工點(diǎn)擊看似來(lái)源合法的電子郵件里的惡意鏈接。一些最常見(jiàn)的網(wǎng)絡(luò)釣魚(yú)手段則是黑客以銀行或同事的名義發(fā)送欺騙性垃圾郵件。
這類(lèi)黑客攻擊手段在新冠疫情期間尤為普遍,騙子向人們大量發(fā)送聲稱(chēng)來(lái)自于美國(guó)疾病控制與預(yù)防中心(Centers for Disease Control and Prevention)以及其它應(yīng)對(duì)全國(guó)性疫情的相關(guān)組織的欺騙性信息。
IronScales和Vade Secure等數(shù)家網(wǎng)絡(luò)安全初創(chuàng)公司正在借助機(jī)器學(xué)習(xí)來(lái)識(shí)別釣魚(yú)郵件。風(fēng)險(xiǎn)投資者認(rèn)為,這些初創(chuàng)企業(yè)有望成為大型企業(yè)。
Tessian的聯(lián)合創(chuàng)始人及首席執(zhí)行官蒂姆?薩德勒表示,為了建立相關(guān)模型,他們會(huì)先收集分析公司的電子郵件數(shù)據(jù),比如員工用于聯(lián)系客戶的常用郵箱地址。然后,他們會(huì)使用這些數(shù)據(jù)來(lái)訓(xùn)練機(jī)器學(xué)習(xí)模型,該模型能夠在員工點(diǎn)開(kāi)新的電子郵件前事先掃描它們并標(biāo)記出可疑郵件。
機(jī)器學(xué)習(xí)系統(tǒng)還會(huì)闡述懷疑原因,例如電子郵件中附有一條陌生網(wǎng)絡(luò)鏈接或員工姓名拼寫(xiě)錯(cuò)誤。Tessian的聯(lián)合創(chuàng)始人及首席技術(shù)官埃德?畢曉普解釋說(shuō),如果員工們通常叫經(jīng)理Cliff,但某封電子郵件稱(chēng)其為Clifton, 那么Tessian的技術(shù)可能就會(huì)識(shí)別出這種異常。
薩德勒承認(rèn),“機(jī)器學(xué)習(xí)系統(tǒng)仍然存在許多缺陷”,有時(shí)候該公司的人工智能會(huì)將合法郵件錯(cuò)誤標(biāo)記為欺詐郵件。但他表示,Tessian一直在努力避免該軟件錯(cuò)誤標(biāo)記真實(shí)郵件的次數(shù)過(guò)多。
薩德勒說(shuō),總部位于倫敦的Tessian計(jì)劃將一部分最新融資用于招聘,爭(zhēng)取將員工人數(shù)從170人增加到220人,再到今年年底的250人。該公司還計(jì)劃改進(jìn)其技術(shù),擴(kuò)大識(shí)別范圍到其它通信服務(wù)領(lǐng)域(比如短信或辦公聊天軟件)的網(wǎng)絡(luò)釣魚(yú)攻擊。
試圖打擊網(wǎng)絡(luò)釣魚(yú)的公司所面臨的一大挑戰(zhàn)是,隨著自然語(yǔ)言處理技術(shù)的發(fā)展,釣魚(yú)郵件越來(lái)越像真實(shí)郵件了。自然語(yǔ)言處理是人工智能的一個(gè)子領(lǐng)域,是指機(jī)器理解并解釋人類(lèi)寫(xiě)作、說(shuō)話方式的能力。畢曉普表示,隨著優(yōu)秀的語(yǔ)言模型的進(jìn)步,例如由人工智能公司OpenAI訓(xùn)練與開(kāi)發(fā)的GPT-3模型(Generative Pretrained Transformer-3,第三代生成式預(yù)訓(xùn)練轉(zhuǎn)換器——譯注),犯罪分子打造針對(duì)特定收件人的個(gè)性化釣魚(yú)郵件時(shí)的難度會(huì)變得更低。比如,這樣的電子郵件可能會(huì)包含人工智能生成的信息,其寫(xiě)作風(fēng)格類(lèi)似于員工老板,導(dǎo)致辨別真假的難度更高。
因此,Tessian以及其它公司都在盡力改進(jìn)他們的人工智能,以識(shí)別出由更先進(jìn)的人工智能支撐的網(wǎng)絡(luò)釣魚(yú)攻擊,這種攻擊有朝一日可能會(huì)“像垃圾郵件一樣普遍”,畢曉普說(shuō)。(財(cái)富中文網(wǎng))
譯者:Claire
Many cybersecurity companies say artificial intelligence could better combat a popular hacking tactic known as phishing.
One such firm, Tessian, said on May 25 that it has raised another $65 million in funding that values it at $500 million. March Capital was the lead investor, while other participants included Accel, Balderton Capital, Latitude Venture Partners, Sequoia Capital, and Schroder Adveq. Since its founding 8 years ago, Tessian has raised a total of $137 million.
In a phishing attack, criminals dupe unwitting workers into clicking on malicious links in emails that appear to come from legitimate sources. Some of the most common phishing attacks involve hackers sending bogus emails resembling messages from banks or colleagues.
Phishing attacks have become particularly prevalent during the COVID-19 pandemic, with scammers sending people phony messages claiming to be from the Centers for Disease Control and Prevention and other organizations involved with national coronavirus response.
Several cyber security startups like IronScales and Vade Secure are using machine learning to spot phishing emails. Venture capitalists are betting that these startups will eventually become big businesses.
Tessian co-founder and CEO Tim Sadler said that his startup analyzes a company’s corporate emails to discover patterns, such as common email addresses that people correspond with, which could indicate that they are messages to customers, for instance. The company then uses this data to train a machine-learning model, which can scan emails and flag those that are suspicious before employees click on them.
The machine learning system also displays the reasons why it suspects an email is fraudulent, such as it featuring a strange web link or misspellings of employee names. If a manager is known to workers as Cliff, but the email refers to the boss as Clifton, Tessian’s technology may spot the discrepancy, explained Tessian co-founder and chief technology officer Ed Bishop.
Sadler acknowledged that “a machine learning system is never going to be perfect,” and sometimes the startup’s A.I. can incorrectly flag legitimate emails as bogus. But, he said Tessian has been working on preventing the software from over flagging genuine emails.
Tessian, based in London, plans to go on a hiring spree with its latest financing, boosting its headcount from 170 employees to 220 to 250 by the end of the year, Sadler said. The startup also plans to improve its technology so that it can be used to spot phishing attacks on other kinds of communications services, like text messaging or work-chat services.
One challenge facing companies trying to combat phishing is the rise of more realistic attacks aided by advances in natural language processing, a subset of A.I. that involves computers creating and understanding text. Bishop said that advances in powerful language models like OpenAI’s GPT-3 system could lead to criminals more easily creating phishing emails that appear to be personalized to particular recipients. For instance, such an email could contain an A.I.-generated message in which the writing style is similar to a worker’s boss, making it harder to spot a fraud.
As a result, Tessian, and other companies, are on a quest to improve their A.I. to detect more advanced A.I.-powered phishing attacks, which could one day be as “prevalent as spam,” Bishop said.