With AI2, Machine Learning and Analysts Come Together to Impress, Part 2: The Algorithms

AI2 is an "analyst-in-the-loop" system, meaning that it exploits the expertise of a security analyst to improve itself. A "human-in-the-loop" system is used to generate more supervised examples for the machine learning stage to use in an iterative training algorithm. This is exactly what AI2 does, allowing feedback to make the machine gradually smarter in the security domain. According to the paper "AI2: Training a big data machine to defend," the system consists of four components: The web logs are to prevent web attacks while specifically indicating the use of firewall logs to stop data exfiltration. This is an interesting use case and is often difficult to detect.