/

1. Applying AI for Threat
Detection in the World of
Cybersecurity
Aleksa Stojanovic
Application Security Engineer

2. AGENDA /
CONTENT
 Introduction
 Artificial Intelligence and Cybersecurity
 AI/ML/DL
 AI approach and Traditional security
approach
 The Importance of AI
 Advantages of applying AI
 Use-cases
 Conclusion

3.  Traditional security methods are no longer sufficient
 AI approaches have been proven to be a better solution
 An undefended attack can not only cause direct harm to business
operations, but they can also lead to the loss of user trust and the
reputation of the affected entities
 AI provides us with tools for a fast and proactive response to diverse
threats emerging from the digital environment
 Information security – comprehensive concept
Introduction

4. AI and Cybersecurity
Artificial Intelligence vs Data Analytics:
 AI systems are dynamic – they get smarter with the more data they
analyse, they “learn” from experience.
 Data analytics (DA), is a static process that examines large data sets to
draw conclusions about the information they contain with the aid of
specialized systems and software. DA is not self-learning.
 Market value
 Usage of AI-driven solutions

5. Artificial Intelligence/Machine Learning/Deep Learning
 AI is designed to give computers the full responsive ability of the human
mind.
 ML uses existing behaviour patterns, forming decision-making based on
past data and conclusions. Human intervention is still needed for some
changes.
 DL works similarly to machine learning by making decisions from past
patterns but adjusts on its own.

6. AI approach and Traditional approach
 Pre-AI era – signature-based detection systems compared incoming network traffic to a predefined database of
known threat signatures
 Manual analysis was central to traditional cybersecurity operations
 Rule-based systems operate by establishing strict rules and policies that define acceptable network behaviour
 Traditional approach demonstrated effectiveness in specific scenarios, it often proved inflexible and struggled to
adapt to emerging cyber threats
 Additionally, the ubiquity of connected devices on the Internet of Things (IoT) further expands the attack surface
 The distinction between AI from traditional cybersecurity approaches lies in its ability to continuously learn and
adapt.

7. The importance of AI
 AI-driven automation leads to cost reductions.
 Automated routine tasks minimize the need for manual
intervention, saving valuable time and human resources.
Cost Reduction
 AI algorithms can effectively analyse a vast amounts of data.
 AI can detect subtle indicators of cyber threats that may
escape human analysts, ensuring a proactive defence
posture.
Improved Scalability
As organizations confront an overwhelming volume of data requiring analysis for potential risks, strengthening cybersecurity becomes
crucial.

8. Advantages of applying AI
 Advanced Threat Detection
 Real-time Analysis
 Automation of Routine Tasks
 Behavioural Analysis
 Reduced False Positives
 Improved Incident Response

9. Use-cases
 Threat detection and prevention
 Malware and Phishing
 Security log analysis
 Endpoint security
 Encryption
 User behaviour analytics
 Advanced threat response and mitigation
 Vulnerability assessment and management
 Threat intelligence and predictive analytics

10. Threat Detection and Prevention
 AI can analyse large amounts of data from different sources and identify unusual patterns in users' behaviour
 Malware and phishing detection – analysing email content and
detecting spear phishing
 Security log analysis – analysing a vast amounts of log data in real
time
 Endpoint security – dynamic approach, establishing baselines of
normal endpoint behaviour and detecting deviations in real time
 Captcha, face recognition, fingerprint..
 Encryption – still a big challenge

11. User behaviour analytics /
Advanced threat response and mitigation
User behavior analytics (UBA/UEBA) solutions use
AI to analyse large datasets with the goal of
identifying patterns that indicate:
 Security breaches
 Data exfiltration
 Malicious activities
Creating deployed application profiles and
analysing vast user and device data
 Automatic responses to various cyber threats
from different vectors
 AI autonomously generates detailed cyber
threat responses

12. Vulnerability Assessment and management /
Threat Intelligence and predictive analytics
 Using UEBA (User and Entity Behaviour Analytics)
for analysing
 By proactively protecting against undisclosed
vulnerabilities, AI enables a real-time defence
against high-risk threats
 AI can predict the areas most susceptible to cyber
breaches
 Holistic view of the organization's security posture
 PayPal transactions

13. When not to use AI in Cybersecurity
 Small or outdated dataset – try with traditional rule-based systems
 No expertiese
 Old infrastructure
 No hardware or cloud resources

14.  AI gives the much-needed analysis and threat identification that can be used by security professionals to minimize
breach risk and enhance security posture
 Achieving a balance between the advantages and disadvantages of AI is the goal for the upcoming years
Conclusion

15. Applying AI for Threat Detection in the World of Cybersecurity
astojanovic@mds.rs
Thank you for your attention and time
Email: astojanovic@mds.rs