Dr Jonathan Francis Roscoe (BT Applied Research)
Automated Cyber Threat Detection and Response
Cyber defence is traditionally managed in direct response to vulnerabilities and threats within an IT system. However, security is a non-exhaustive exercise and in the face of an ever-changing threat landscape with highly-motivated threat actors there is a strong need to automate our cyber capabilities.
In this talk we’ll explore how artificially intelligence and machine techniques are being practically deployed for the protection of enterprise networks and critical infrastructure. Firstly, we’ll how we better utilise threat intelligence and network telemetry to detect threat activity on our networks.
AI/ML technologies are powerful tools to enhance the work of security professionals faced with increasingly complex and broad challenges. We’ll discuss practical measures in augmenting human expertise with new automated technology.
We’ll go on to explore the use of reinforcement learning to drive the simulation of threat events on our network in order to automate the response to developing events. Such simulation can support red/blue-team testing in a much more exhaustive manner.
Jonathan Francis Roscoe leads the Automated Detection and Response research group at BT. Jonathan is responsible for managing teams of researchers delivering innovation in cyber defence for BT and its customers.
His research interests include anomaly detection, neural networks, malware, red-teaming, disinformation, privacy and open-source intelligence. His work investigating dark web marketplaces and malware vendors was given the TEISS Information Security award and ITP Innovator of the Year. Outside of BT, Jonathan is chair of the IEEE UK&I Cyber Security group as well as an expert fellow to the SPRITE+ network on security, privacy and identity.
