Is the Future of Cyber Security in the Hands of Artificial Intelligence (AI)? — 1
By: Ensar Seker
Tags: Cybersecurity, Towards Data Science, Supervised Learning, Machine Learning, Unsupervised Learning

Is the Future of Cyber Security in the Hands of Artificial Intelligence (AI)? — 1

It is a fact that machine-learning has taken great steps in recent years, from autonomous tools to virtual assistants, from chatbots to face/object recognition. What about cybersecurity? Ensar Seker Jun 10, 2020·6 min read

Chinese philosophy yin and yang represent how the seemingly opposite poles can complement each other and achieve harmony.

In cybersecurity, this ancient philosophy perfectly represents the relationship between supervised and unsupervised machine learning. For example, monitored machine learning processes can be used for detection, while unsupervised machine learning uses clustering. In the case of cybersecurity and data security research and development, monitored machine learning is often implemented in the form of machine learning algorithms.

It is not easy to describe Artificial Intelligence (AI). It has no clear definition. Most of the existing definitions try to express AI as a computer process that mimics human intelligence and behavior and acts intelligently. But this situation brings more questions such as what is intelligence? Do people always act smart and logical? Is the desired achievement for AI, human intelligence? Or can a computer perform better than a human? The definition of approaches that base AI on rational behavior refers to a computer doing things that are difficult to do. In this article, however, a pragmatic approach is adopted to simplify the issue and AI is defined as a scientific area responsible for producing computer-based solutions to the complex problems that human beings have difficulty in finding solutions.

AI Technology Landscape

The use of AI in cybersecurity is relatively new. While some cybersecurity experts argue that the answer to cybersecurity is machine learning to detect sophisticated breaches and that cybersecurity will only continue to succeed if the IT environment is secured by the help of AI-based solutions. Others argue that while machine learning is very good at finding similarities, it is not good enough at detecting anomalies and is therefore not suited to cybersecurity.

Beyond these discussions, it is a fact that machine-learning has taken great steps in recent years, from autonomous tools to virtual assistants, from chatbots to face/object recognition. As we move towards a future where cybersecurity is much more integrated into our daily life, it is important to be aware of different approaches based on machine and deep learning in order to better defend the network and data security against increasingly complex and advanced attacks.

As you already may know, there are four types of machine learning algorithms to train a machine neural network: Supervised Learning, Unsupervised Learning, Semi-supervised Learning (also known as active learning), Reinforcement Learning. Supervised learning is about learning from a training data set, while unsupervised machines learn from the data itself that is limited in its ability to detect threats, as it only looks for details it has seen and flagged before, while unsupervised learning constantly scans the network and finds anomalies. Unsupervised learning, however, does not require labeled training data and is better suited to detecting suspicious activity, including detecting attacks that have never been observed before.

Supervised learning is about learning from a training dataset. Supervised machines learn from the data itself, which is limited only by its ability to detect threats when searching for details that it has previously seen and marked. For unattended learning, tagged training data is not required and is more suitable for detecting suspicious activity, including detecting attacks that have never been observed before. Unsupervised learning constantly scans the network and finds anomalies.

Machine Learning Algorithms

Machine learning is already used to reduce the load that attack detection and prevention tools can handle as part of cybersecurity systems. AI algorithms similar to real human decision mechanisms try to model a decision mechanism.

There have been a number of attempts to override unattended machine learning security solutions, resulting in a host of untested solutions to a variety of security problems. Many of these early attempts had difficulty generating enough data to effectively detect complex breaches such as identity fraud and advanced cyberattacks.

By contrast, unsupervised machine learning is about finding and describing the hidden structures in the data. This problem is related to the problem of defining distance functions, since most, if not all, cluster algorithms are based on numerical and non-categorical data, and therefore we hear as much about cluster algorithms as we do about classification.

In the context of cybersecurity, AI tries to defend the system by weighing behavior patterns that indicate a threat to the systems. From this point of view, machine learning is the process of learning patterns that lead to malicious behavior.

AI solutions are generally analyst-oriented and unsupervised machine learning-focused in information security. Using unsupervised machine learning to detect rare or abnormal patterns can increase the detection of new attacks. However, it can also trigger more false positives and warnings. This requires a significant amount of analysis effort to investigate the accuracy of these false positives. Such false alarms can cause alarm fatigue and insecurity and, over time, lead to its return to analytical-focused solutions and the resulting weaknesses. Three major challenges facing the information security industry, each of which can be addressed by machine learning solutions, have been identified as follows [2]:

Missing or Lack of Tagged Data: Many organizations lack the ability to use tagged examples and supervised learning models of previous attacks.

Continuously Evolving Attacks: Even though controlled learning models are possible, attackers can change their behavior and override them.

Limited Time and Budget for Research or Investigation: Applying to analysts to investigate attacks is costly and time-consuming.

As the industry is still experimenting with the technology as a proof-of-concept, however, the idea of trust is ideal where the security solution is machine learning. It can help to improve the fight against cybercrime, and while AI can boost human efforts by automating the pattern-recognition process. Machine learning systems report useful data based on categories, while analysts talk openly about how machine learning can be a black box solution for security, where CISOs are not quite sure what is under the hood.

Today, AI is not ready to replace humans, but by automating the pattern-recognition process, it can enhance human efforts. There is a truth here that cannot be denied because machine learning has very different uses in cyber defense.

Considering all usage areas, it is possible to evaluate the use of AI in cyberspace in two categories; the use of artificial intelligence for cyber defense and the use of artificial intelligence for the cyber offense.

In part II, we will talk about the use of artificial intelligence for cyber defense…

Sources

[1] K.R. Chowdhary, “Fundamentals of Artificial Intelligence,” Springer India, 2020.

[2] K. Veeramachaneni, I. Arnaldo, A. Cuesta-Infante, V. Korrapati, C. Bassias, K. Li, “AI2: Training a Big Data Machine to Defend”, IEEE International Conference on Big Data Security in New York City, 2016.