# Applications of Machine Learning in Cyber Security: A Review
## 6 Shortcomings in Existing IDSs
### Ethical AI and Compliance Aspects  
Ethical AI principles can play a significant role in how machine learning (ML) models are developed and applied in a cyber security context by providing additional considerations around transparency, fairness, privacy, and accountability. These principles add valuable requirements that contribute to the ethical development of ML models and also result in more robust models, increased user trust, and better regulatory compliance. Integration of ethical AI principles can be well understood through the process and benefits described in a few pioneering case studies. 1. Transparency: In the cyber security world, transparency is essential, and transparency about the model's decision-making process is especially vital in capturing why the model sets off an alert or makes specific predictions. Explainable AI (XAI) techniques like SHAP (Shapley Additive Explanations) and LIME (Local Interpretable Model-Agnostic Explanations) can be used to elucidate the inner workings of a model and provide insight into its threat detection abilities for human understanding and trust. An informational case example within the IBM Watson for CS ([[https://medium.com/trusted-ai/explainability-using-sharp-in-ibm-watson-openscale-55548](https://medium.com/trusted-ai/explainability-using-sharp-in-ibm-watson-openscale-55548) adedf38]([https://medium.com/trusted-ai/explainability-using-sharp-in-ibm-watson-openscale-55548](https://medium.com/trusted-ai/explainability-using-sharp-in-ibm-watson-openscale-55548) adedf38), accessed on 3 November 2024) project focused on how to make [PERSON]'s detection approach transparent using natural language processing to reveal real-time information for a batch of incidents. SHAP integration proved essential to explain features that contributed to the detection of threats, easing the interpretation of the model for cyber security teams. 2. Fairness and bias mitigation: In the scope of cyber security, fairness can be ensured if ML models prepared for threat detection do not discriminate against any group of malicious activities or any potentially relevant data source from which threats might arise. A case study of bias in a cyber security dataset could use SMOTE to address the data bias, problem where the team aimed for a more balanced cyber security dataset, allowing the system to recognize a large and diverse set of malicious threats, thus lowering the possibility of biased detection. Microsoft has published extensively in this domain ([[https://www.microsoft.com/de-ch/ai/responsible-ai](https://www.microsoft.com/de-ch/ai/responsible-ai)]([https://www.microsoft.com/de-ch/ai/responsible-ai](https://www.microsoft.com/de-ch/ai/responsible-ai)), accessed on 3 November 2024). 3. Privacy and security: Privacy-preserving techniques such as differential privacy or federated learning ensure that individual data are protected. Google's Federated Learning for Mobile Threat Detection epitomizes privacy-centric cyber security ([[https://research.google/pubs/federated-learning-for-mobile-keyboard-prediction-2/](https://research.google/pubs/federated-learning-for-mobile-keyboard-prediction-2/)]([https://research.google/pubs/federated-learning-for-mobile-keyboard-prediction-2/](https://research.google/pubs/federated-learning-for-mobile-keyboard-prediction-2/)), accessed on 3 November 2024 ). This approach detects malware by training models directly on users' devices rather than centralized servers. Through this distributed approach, detection happens without sacrificing sensitive data, and the certainty of a balance between security and privacy is achieved. 4. Accountability with auditability: This can involve the provision for audit trails, along with auditing of any changes in model performance. The EU's AI4 Cyber ([https://ai4 cyber.eu/](https://ai4 cyber.eu/), accessed on 3 November 2024) project team included an audit framework for cyber security models.