-6

I looked at using python for the AI in a security application for hobby-business but apparently you either release it as source code or it can be easily decompiled. Of the new machine learning languages/packages, which can be kept confidential?

Likely I would use it to identify between good and bad traffic and content for a network intrusion prevention system and content filtering. The language I would use for all the network programming would be C/C++. That can't change.

By business I mean selling it for a dollar eventually... maybe. I'm basically choosing what I'm going to program in my free time and would be learning(I'm new) both C++ and the AI language. Thank you for taking the time.

  • 4
    Confidentiality is a question of contracts, not language. If you feel that your clients are stealing your code, there is an easy solution: don't do business with criminals. – Jörg W Mittag Jun 8 '17 at 21:25
  • 1
    Note that asking for language recommendations is off-topic. Note also that your underlying problem is a legal problem, which is also off-topic. Note thirdly, that there are plenty of existing questions about preventing reverse engineering, so that aspect of your question is a duplicate. – Jörg W Mittag Jun 8 '17 at 21:26
1

You can use architectural design to make sure your code remains confidential. If possible, you could create a web service that holds the AI logic. You would then write a client to ask your web service if the given traffic is good or bad etc. This way your algorithm is never on the clients computer. You can add authentication to your service so the client must pay you to use it.

Any software can be decompiled, and given enough time and desire can be reverse engineered and understood. The best way to maintain confidentiality is by not allowing the software to leave your hands at all.

  • 1
    A web-based based firewall is going to have some practical problems. – whatsisname Jun 8 '17 at 21:25
  • If you give customers your code, then they have your code. The only way to prevent your customers from getting your code is to not give it to them. If you don't want to give your customers your code, but also can't not give them your code, then you are SOL, and need to re-think your business. Don't do business with criminals who steal your code would be one possibility. Make your product so good that people gladly pay for it is another. Offer services in addition to your product and make money off that, is a third. (I've seen all three work.) – Jörg W Mittag Jun 8 '17 at 21:30
  • Wouldn't that involve the high cost of SaaS? I thought of this but I think that sending a business's traffic out elsewhere would be to big and bad for confidentiality. A simplified representation of the traffic data might be taking away too much detail for the AI to make an accurate identification. – WaterKnight Jun 8 '17 at 21:32
  • Those are all good points. I'm not positive a service would work, but there already exist services for digesting server logs and IOT sensor data to provide realtime decisions. Network traffic data seems very similar. – Samuel Jun 8 '17 at 21:38
2

Of the new machine learning languages/packages, which can be kept confidential?

None. All.

Which language you use is irrelevant. If someone has control over the hardware your software is running on, they can convert it from whatever format it's in into a more readable one. Not necessarily the original form, but certainly something they can use.

If they don't have access to the hardware, and are restricted to interacting with the software through a remote API, then it doesn't matter whether it's interpreted source code or compiled machine code, they won't be able to tell either way. It could be a bunch of well trained monkeys for all they know. Assuming, of course, you're not unintentionally leaking information via your API.

  • How can information be leaked "via your API"? – WaterKnight Jun 8 '17 at 22:54
  • By outputting your source code as plain text due to misconfigured host settings, for example. Or leaving the DEBUG verb turned on. Or returning error stack traces. Or allowing the user to access arbitrary memory through well crafted attack strings. It's not an easy problem. – Kevin Fee Jun 8 '17 at 22:56
  • Wow, I'm Security+ but never heard of this, thanks for bringing it up I'm glad I'm aware of it now. – WaterKnight Jun 8 '17 at 23:01
  • Then I'd suggest doing some research into web based security. Look up OWASP (owasp.org/index.php/Top_10_2013-Top_10). There's also some pretty good courses on infosec on Pluralsight, if you have a subscription. Troy Hunt has some really good ones. – Kevin Fee Jun 8 '17 at 23:17
0

So here's the issue. There really isn't any language you can write something in and expect that someone out there wont try and decompile it/get access to your code. Its just impossible. Look at games, people spout off the DRM they use is unbreakable yet its broken days later.

You can take precautions to protect you and your IP, so for example releasing it with the proper licenses, registering copyright etc. Or better yet keep your source code secure. But in the long run this is a hard one.

Also, if your looking for a language to use, pick whichever. Honestly if its partly as a hobby, you can use it as a learning tool, and heck maybe you'll surprise yourself at what you can do with the language. Though if i had to pick, since your already doing C/C++, id say go with that.

0

You cannot give someone your software and not give it to them at the same time. Your options:

  1. Treat this as a social problem rather than a technical one, and solve it with social means (licensing). Technical means such as watermarking can help enforce these means, but they're still social means.
  2. Allow people to use your software without actually giving it to them. This means that you will have to run all the valuable logic on a server you control, and grant people access through well-defined interfaces. In other words, don't sell the software, sell the service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.