How AI and Machine Learning in Cybersecurity Buzz Gets the Trends Wrong

Machine learning algorithms are not ready to take over on both sides of the fence. They are just a powerful tool that both security specialists and their adversaries use in their arms race.

The buzz about machine learning (ML) is overwhelming. No wonder it is also present in such a profitable and advanced sector as cybersecurity. Actually, the InfoSec business has been using artificial intelligence (AI) for a very long time, and the recent boom in the adoption of ML techniques (algorithms being trained on a data set, and later able to extrapolate the rules giving precise answers on new data sets) didn't go unnoticed.

Probably you came across an InfoSec company's marketing piece describing how algorithms can detect fraud, malware or network security breaches on the fly. Alternatively, maybe you heard a more sophisticated sales pitch saying how threatened and vulnerable world is due to imminent AI cyberattacks. Both are not true.

While ML creates an opportunity for the two sides of the cybersecurity arms race, the balance remains untouched, and it seems that the expected development of AI won't dramatically tip the scales as both sides benefit from deep learning methods that outperform traditional rule-based solutions.

Organizations need to react to ML-based traps

The problem is the industry's drowsiness. Cybersecurity solutions have been traditionally expensive and time-consuming to implement, especially in big organizations. That is why most security systems work using old-school rule-based or signature-based technology that doesn’t work on new sets of data. An attacker can change the signatures to penetrate the network.

Hackers can use neural networks to train their malware using historical data. It's enough to "feed" an algorithm with the scenarios of phishing emails that were blocked or succeeded in bypassing a detection system. According to specialists, this can increase the attacker's success rate against an AI system from 0.3% to an astonishing 15%.

Additionally, an ML algorithm can help phishers prepare the most effective email that will maximize the "conversion" rate of a system penetration, for example, the number of people clicking a fraudulent link and logging into a fake bank account revealing their password.

One of the most popular ways of dealing with ML security systems is "data poisoning." The deep learning frameworks are no secret, and everyone knows the general rule. If you spam the AI system by marking malware as "safe", it is possible you will cause a security breach, and you are free to roam around the compromised system in the time before a human specialist closes it.

How ML may be useful to protect us

Machine learning can be used to look for more sophisticated characteristics of malware than just precise rules and signatures. It makes a hacker's job much more difficult. Neural networks can learn entirely new ways of detecting anomalies, while the exact mechanism stays unknown even to the engineers supervising them. An ML model can identify malware even if it sees it for the first time.

One of the methods is the analysis of components. Cybercriminals hardly ever build their viruses and trojans from scratch. They pick up ready-to-use blocks of code, since they need many trials before they succeed with a spectacular attack that will bring them a substantial profit. They cannot afford too much coding, and this is the chance for a modern antivirus systems to detect them.

As the mechanical solutions are usually well balanced on both sides, the biggest threat is human error. To protect against it, security specialists apply deep learning in so-called User and Entity Behaviour Analytics (UEBA). Biomimetic data such as keystroke dynamics can be used to verify suspicious patterns. A neural network can profile users and network nodes in an organization, trying to find anomalies that are later examined by a human team.