Cato Network's secure access service edge (SASE) platform got an upgrade today with the introduction of machine learning-enhanced reputation assessment capabilities.

The vendor claims it can effectively eliminate false positives by joining threat intelligence with real-time network information. An internal survey of more than 400 Cato customers over a three-month period resulted in less than seven false positives per month, according to the company.

"We feed our intrusion prevention engine with tons of reputation data. This reputation data is coming from nearly 200 different sources. Some are community sources, some are paid sources, but it sums up to more than five million records that process on an hourly basis," explained Eyal Webber-Zvik, VP of product marketing at Cato, in an interview with SDxCentral.

These records are cross referenced not only against each other but by network information collected throughout the SASE software stack to provide additional insights and better identify issues.

From here, machine learning algorithms and are used to simulate the impact on the network using historical data, and then in the wild, before they are pushed to the company's points of presence.

What sets Cato's offering apart is its ability to put the threat intelligence into context, Webber-Zvik said.

For example, a headless browser client going to a not-yet-classified URL "is not a problem on its own, but suspicious as part of a greater context. ... But if you looked at each data point in isolation, you won't be worried about it," he said.

"The result is our customers run a full blown enterprise-grade intrusion prevention system (IPS) that is not limited by any compute resources. ... And all the signatures and reputation data is validated before it goes into prevention mode to eliminate false positives," Webber-Zvik said.

IT teams are almost always short staffed, "so every time there is a complaint about a signature, somebody would call the security team and say 'the IPS broke the application again,' and they would shut down that signature package instead of fine tuning the exact signature," he added.

By identifying and detecting potential false positives before the customer runs into issues, Webber-Zvik claims it's possible to reduce the workload for IT teams dramatically, freeing them to be more proactive.

Machine learning is nothing new for Cato.

"We've been doing a lot of machine learning and AI (artifical intelligence) throughout the entire service," said Webber-Zvik. "We have machine learning algorithms that we've built and trained to monitor our network and automatically take out service components that misbehave or underperform."

For example, one use of machine learning is to detect packet loss across its backbone providers. If packet loss exceeds the acceptable range, the software can automatically shift the traffic and notify the vendor's operations team.

And while the use of machine learning is not unique among SD-WAN, security, or SASE vendors, Webber-Zvik said that many vendors are hamstrung by having to normalize data from point solutions before it can be correlated.

"The reason you don't see many [artificial intelligence] and [machine learning] announcements or implementations from other SASE vendors is because most of them are not cloud native, or they don't have the entire [software] stack in the cloud," he claimed.

Cato's reputation system is now available to all customers.