Artificial Intelligence & The Future Of Cybersecurity

As more cyber-security threats arise every day, extensive research into prevention and detection schemes is being conducted globally.

One of the issues faced is keeping up with the sheer mass of new emerging threats online. Traditional detection schemes are rule or signature based. The creation of a rule or signature relies on prior knowledge of the threats structure, source and operation, making it impossible to stop new threats without prior knowledge.

Manually identifying all new and disguised threats is too time-consuming to be humanly possible. One solution that's getting global recognition is the use of artificial intelligence.

The subset of AI that relates to cyber-security is the ‘learning' branch. This field, called 'Machine Learning', relates to the capability of a computer to learn from data and improve over time. AI can use knowledge it gains to detect threats, including those that are yet to be discovered, by identifying shared characteristics within families of threats.

Decision making

It is hard to believe AI could one day replace a room full of humans monitoring a network. The human brain is limited in its ability to simultaneously consider multiple variables during decision-making. Psychologist Graeme Halford estimated this number between four and five variables at any one time. AI has filled this gap by providing a tool that can take into account hundreds of variables at a time, whilst processing millions of records per second.

Working together

AI is most accurate when it can get feedback on the decisions it is making. One thing AI cannot currently borrow from humans is the ability to assess a decision based on the situation and environment. Combining the situational and environmental awareness of a human with the data processing and pattern recognition abilities of AI makes for the strongest possible detection scheme. 

This was recently proven by a research team at MIT with the creation of their AI Squared detection scheme that used AI learning reinforced by a security analyst giving the AI feedback on its most unusual decisions. This reduced the number of false positives the AI was making by a factor of five.

Cyber-threats are rapidly evolving. Attacks are stealthier, more targeted and more evasive than ever before. Because of this, we tend to move away from prevention towards detection, relying upon a human component to take action. 

What is abnormal is not necessarily intrusive, and what looks to be legitimate might not be within a given context. Attackers can use stolen credentials and access systems posing as a legitimate user. There is no way to differentiate this from a regular user without situational awareness. Because of this, humans must remain in the detection scheme, whether it is to take action or provide feedback to the system for it to improve.

What to expect

The future of cyber-security will continue as it always has, as a game of cat and mouse.  Attackers will create new methods of concealment and defenders will create new methods of detection. The difference with AI is that we are trying to make something that will adapt to the changes the attackers make. 

Current research suggests we will soon see distributed AI detection schemes operating similarly to the human immune system, giving some form of environmental awareness. Like the human immune system, one part would be dedicated to addressing common threats (innate immune system), whilst another part would investigate anomalies to detect threats that have not yet been seen by the system (adaptive immune system).

The primary objective of AI-based security solutions is to help detect what other controls fail to. Many researchers and vendors are claiming unheard of accuracy rates for their AI detection schemes. Specific families of threats can be detected in a very accurate manner, however, emerging families of threats may display changing characteristics, or characteristics that purposefully try and trick AI detection. This makes accuracy metrics relative as researchers and vendors can only assess the detection performance against a small set of threats, amongst infinite real-world possibilities. 

There are good products out there that will truly enhance your security posture, however, accuracy statistics are more of a selling point than a feature to be relied upon. For now, AI detection schemes are strongest alongside human decision makers. This will make them commonplace in environments like security operations centres in the near future, allowing a huge workload to be alleviated with help from AI.

SC Magazine

 

« The White House Has Four Keys To Improving Cybersecurity
GCHQ To Create A UK National Firewall »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

XYPRO Technology

XYPRO Technology

XYPRO is the market leader in HPE Non-Stop Security, Risk Management and Compliance.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

SecurityMetrics

SecurityMetrics

SecurityMetrics is leader in data security, PCI, and HIPAA compliance solutions

Marsh

Marsh

Marsh is a global leader in insurance broking and risk management and has been a leader in combatting cyber threats since their emergence.

CERT-UA

CERT-UA

CERT-UA is the national Computer Emergency Response Team for Ukraine.

The Open Group

The Open Group

The Open Group: Leading the development of open, vendor-neutral IT standards and certifications.

MedCrypt

MedCrypt

MedCrypt are a team of medical device experts focused on bringing modern cybersecurity features to the next generation of healthcare technology.

Maximus Consulting (MX)

Maximus Consulting (MX)

Maximus designs and delivers corporate-wide information security management system with our full-time IRCA Accredited consulting team.

CipherBlade

CipherBlade

CipherBlade specializes in blockchain forensics, data science and transaction tracking.

Sonrai Security

Sonrai Security

Sonrai Security delivers an enterprise security platform focused on identity and data protection inside AWS, Azure, and Google Cloud.

MSPAlliance

MSPAlliance

MSPAlliance is the world’s largest industry association and certification body for cloud computing and managed service professionals.

Neosecure

Neosecure

NeoSecure is a specialist Cybersecurity Solutions and Managed Services provider in Latin America.

SilverSky

SilverSky

SilverSky offers a comprehensive suite of products and services that deliver unprecedented simplicity and expertise for compliance and cybersecurity programs.

Constella Intelligence

Constella Intelligence

Constella Intelligence provides digital risk protection services to quickly and efficiently disrupt cyber attacks and data breaches before they occur.

InferSight

InferSight

InferSight can help you design an architecture that takes into account security, performance, availability, functionality, resiliency and future capacity to avoid technological lock in and limitations

Accops Systems

Accops Systems

Accops enables secure and instant remote access to business applications from any device and network, ensuring compliant enterprise mobility.

Forward Networks

Forward Networks

Forward Networks - transforming networks to be more reliable, agile, and secure.

Strategic Security Solutions (S3)

Strategic Security Solutions (S3)

S3 is a leading provider of Cybersecurity consulting services for Identity and Access Governance (IAG), Zero Trust, and Enterprise Risk and Compliance.