Artificial Intelligence and Cybersecurity

Overview of AI in Cybersecurity
Helping to navigate the AI hype,
and make informed decisions
14/09/2018ICON 2018 - Overview of AI in Cybersecurity - All rights reserved 1

What are we talking about ?

• Machine reproducing human cognitive capabilities such as reasoning,
knowledge representation, planning, learning, natural language processing,
perception, the ability to move and manipulate
• Machine that comes up with novel knowledge that user finds insightful
• Enhance human intelligence with technology
• processing and structuring huge volumes of data, including analysis
of the complex relationships within it
• Cybersecurity use case such as sifting through critical alerts,
correlating them with other lesser alerts and log entries, pulling packet
captures and host activity logs, overlaying external threat intelligence
and data feeds, and presenting an analytics package for a human
analyst to determine the next actions
• 2016, MIT’s Computer Science and Artificial Intelligence Lab (CSAIL):
adaptive machine learning reviewing millions of logins each day, and
reducing alerts down to around 100 per day
• Orchestrate and Automate
• AI scales up tasks that humans can perform without a problem to a
much larger volume we could ever handle
• “Modern” assembly-line robots – replicating repeated mechanical
tasks, not necessarily requiring any "intelligence" as such
Artificial Intelligence
Definition of AI is Difficult
AI can’t work without Humans
Humans are enhanced by AI
Source: PwC14/09/2018ICON 2018 - Overview of AI in Cybersecurity - All rights reserved 3

• AI is Math
• Advanced and new application of Statistics
• Artificial General Intelligence: intelligence of a machine that could
successfully perform any intellectual task
• Machine Learning: ability for (machines) to learn without being explicitly
programmed – predictions based on data sets
• Deep Learning: “New ML” that recognizes patterns - wider range of data
resources, less data preprocessing by humans, produce more accurate
results
• Swarm technology: collective behavior of decentralized, self-organized
systems, natural or artificial - Already used in drones and fledgling
robotics devices
Artificial Intelligence
Overview of AI technologies
Source: Cellstrat

Machine Learning
• Supervised: given inputs (knowledge and data) and
outputs to learn from and provide predictions :
Classification problems - lots of training data and
feedback from humans
• Large data sets – Labeled & Unlabeled
• Volume, velocity and variety of data are key
• Unsupervised: explores input data without being
given explicit outputs and detect anomalies:
Optimisation problems
• Dimensionality reduction - Association &
Clustering of "normal" and "abnormal"
entities
• Reinforcement learning: learning to perform a task
by maximizing reward signals about how well it is
performing
• Don’t have a lot of training data
• Can’t clearly define an end state
Overview of ML underlying technologies
Source: Saagie

• Supervised: get reliable data set
• For last 20 years, e.g. in network attack detection - MIT LARIAT
data set is biased
• Consequences
• Difficulty in training algorithms
• Inability to derterministically label data
• Difficult cleaning data
• Can resulting in false positives
• Unsupervised
• Difficult to explain the clusters
• Difficult to take expert knowledge into account
• Resulting in challenges in finding anomalies in data sets
Machine Learning
Attention points
Source: EY

• Explainability
• Understand what DL actually learned
• Legal challenges
• Verifiability
• Verifiability of detections
• Interpretation of output
• Data quality and Bias
• Not enough or no quality labelled data
• Data cleanliness issues: timestamps, normalization across fields,
etc.
• Bad understanding of the data to engineer meaningful features
• In cybersecurity, data is prone to adversarial input
• Knowledge
• AI solutions depend directly on the qualifications of people
developing the models
• Understanding the business, the maths, and IT
• No well trained domain experts and data scientists to oversee the
implementation
Deep Learning
Attention points

AI in cybersecurity

Red and Blue AI
• AI versus AI cybersecurity competition DARPA "Grand Challenge”
• 2013-2016 – 55M$ event, 3,75M$ prize
Winner: Mayhem – its code is now used by the Pentagone and US Defense
in war zones
• Attack, Defend (Run services and Patch (which created most of
problems))
• Red AI is AI based Cybercrime
• Next Level Threats (NLT’s) based Cyberattacks. This means
cyberattacks which are using artificial intelligence, machine learning
and robotics in combination to make attacks even harder to detect and
fight against.
• Difficult to assess the level of this risk
• Most example in the next slidebelow are at the research stage
• Could some be already available from the Darkweb ?
• Blue Ai is Defensive AI
New risks demand new controls

Red AI
• Malware creation: speed up creation & Enhance evasive capabilities
• Customized undetectable malware using Elon Musk's OpenAI (2017 Defcon)
• Extension on polymorphic malware: modify code on the fly based on how and what
has been detected in the environment
• Smart botnets
• Self learning botnets: actions based on local intelligence and exchanges between
botnets
• Smarter zombies: act without the botnet C&C instructions
• Advanced spear phishing: text-to-speech, speech recognition, and natural language
processing (NLP) for smarter social engineering
• Train on genuine emails and make convincing scams
• “Automated End2End spear phishing on Twitter”: success rate varying between 30
and 60 % (Black Hat USA 2016)
• Counter threat intelligence
• DDoS TI: raising the noise floor generates a lot of false positives to common machine
learning models -> once a target recalibrates its system to filter out the false alarms,
the attacker can launch a real attack that can get by the defensive ML
• Unauthorised access: Breaking current CAPTCHA (98% success)
• Poisoning machine learning engines
• 2017: convolutional neural networks (CNNs) attacked to produce false (but
controlled) results through CNNs like Google, Microsoft, and AWS
• Using AI to classify victims and optimize RoI
• Condition based Cyberattacks e.g. Cyberattacks using Blockchain based
smart contracts
H(igh) – M(edium) – L(ow) risk
S(hort) – M(iddle) – L(ong) termEstimations
H – S
M – M
H – S
M – M
M – S
M – S
? – S
M – S

Blue AI
Source: Raffael Marty
AI seems to be the best defense against Red AI
• Is this a new frontier of information warfare ? Most probably the asymmetric,
instantaneous nature of cyberattacks demand the adoption of autonomous
defense systems that could act in response to an attack in an early stage
• Wannacr, NotPetya etc.
• This will probably generate an AI arms race – what will be the consequences
in the long term, especially as big government actors join the cyber wars
• Resources will be key: money, expertise, processing capabilities, access to
« big data » - e.g. Google’s Chronicle service offering could impact radically
the Blue AI industry with :
• Speed and Scale: massive compute and storage to create more intelligence out of
security-related
• Enhance Human Abilities: ML capabilities to find patterns in huge volumes of data
that aren’t easily spotted by humans
Most Blue AI uses a mix of different technologies such as
• Classification identifies which category a new piece of data belongs to
• Anomaly detection trained on a historical data set then look for anything
new or unusual
• An anomaly might not be a malicious activity
• Training needs to be refreshed regularly, since employees, networks, and other
systems change over time.
• Cluster analysis looks at a much larger variety of factors and behaviors than
a human can, and update the clusters in real time
• still usually takes a human to look at the clusters or anomalies and determine what
they mean

• Malware detection: use large collection of software that's already been divided
into malware and legitimate applications, and tell whether a previously unseen
app is malicious
• Google: ML to analyze threats against mobile endpoints
• Microsoft: multi layered (endpoint & cloud), multi ML endpoint defense
• Anti Spam
• Intrusion Detection & Prevention
• Characterizes the network traffic, and automatically generates signatures for blocking
the attack
• Deep neural networks can create a model to detect attacks with strong accuracy
• Vulnerability management: identifying, prioritizing and helping to remediate
existing vulnerabilities
• User and Entity Behavior Analytics (UEBA): based on analysis of network
traffic, internal and external behaviors, data access and a wide range of other
functions and activities.
• Data classification: ease compliance with data privacy and data protection
regulations
• Amazon Macie automates tracking the data to identify, classify and protect sensitive
pieces of information such as personally identifiable information (PII), personal health
information (PHI), regulatory documents, API keys, secret key material and intellectual
property
• Cyber Threat Intelligence (CTI): behavior categorization for Threat Intelligence
• Arizona State University uses machine learning to monitor traffic on the dark web to
identify data relating to zero-day exploits
• New generation of honeypots
Blue AI
Source: Infotechlead

• Automated remediation
• For the recommendations that carry the lowest risk to the
company, or that offer the highest benefit
• DARPA 2016 Grand Challenge
• Orchestration framework
• Allows one security system to trigger an action on a different
system, without requiring a human intervention (e.g. log into
individual systems and manually execute commands)
• Will demand that “basics” practices are in place, such as security
playbooks
• Intrusion Detection & Prevention - Autonomous incident response
• Watch as security professionals deal with security issues
• Gather enough historical data to make meaningful predictions
• Intrusion Detection & Prevention - Automatic self assessment and
remediation: learn attack behaviors that can evade Intrusion Detection
Systems (IDS), thereby enabling the automated creation of data from
which an IDS system can learn
• Automated pen-testing
• Blockchain could enhance data integrity, digital identities, enable safer
IoT devices to prevent DDoS attacks, etc.
Blue AI emerging usages
Some in R&D, other already provided by start-ups
Source: Microsoft

Thoughts on solutions
Brief look into commercial
cybersecurity with AI
solutions

• Cloud, Blockchain, and now AI ?
• “Cool” products have to have AI
• AI is Math (advanced and new application of Statistics)
• not software
• AI cybersecurity solutions depend directly on the qualifications of people
developing the models
• Data scientists, often PhDs in Math and Computer Science,
sometimes with (pending) pattent
• And Cybersecurity experts, with knowledge of Cyber Threats and
the most appropriate types of defenses
• Hence not limited to IT development profiles
• Scarcity of the profiles
• Hiring and retaining is a major challenge
• Industry, projects and compensation (incl. equities) are key
• Salaries for Data scientists are sky rocking, and not all companies can
compete
• Start-up are more able to provide equities to top talent but less able to
• Develop mature piece of software with this cutting edge
technology
• Have access to big data
Quantum leap of AI software
Difficulty to develop AI solutions
Source: Wikipedia

CISO’s shopping list
80+ companies securing the future with AI
Source: CB Insights
Anti Fraud & Identity Management: secure online transactions by identifying
fraudsters, e.g. ML proactively detects fraud in financial transactions or fraudulent
users on websites and in mobile
Mobile Security: e.g. identify and grade risky behavior in mobile apps including
known and unknown malware, new malware used in targeted attacks, corporate
data ex-filtration, and intellectual property exposure, mostly cloud based
Predictive Intelligence: e.g. predictive and preventive security against advanced
cyber threats with predictive execution modeling
Behavioral Analytics / Anomaly Detection: detect anomalous behavior from
insiders and external threats in organizations’ systems and networks in order
detect cyber-attacks, e.g. with digital fingerprints from an end-user’s behavior
through monitored keystrokes, mouse behavior, and anomaly detection
Automated Security: e.g. automate security tasks across 100+ security products
and weave human analyst activities and workflows together
Cyber-Risk Management: More focus on defining cyber risk appetite and cyber
risk tolerance, to better enable business considering the cost of security controls
App Security: securing applications e.g. By helping developers secure applications
by finding, fixing, and monitoring web, mobile, and networks against current and
future vulnerabilities, with formal analysis and machine learning
IoT Security: e.g. AI-powered asset-protection software for the safety, security,
and reliability of the IoT; machine learning to identify hidden recording devices or
transmitters in a conference room, and allow for a preemptive response to data
theft.
Deception Security: e.g. proactively deceiving and disrupting in progress attacks
by detecting and fighting cyber attacks by creating a neural network of thousands
of fake computers, devices, and services that act like a fog and work under the
supervision of machine learning algorithms.

A few points to look at
Looking into
relying on AI ?
• Asses your threats and risks – are AI based solutions the best answers to
some of them ?
• What is your current maturity in cybersecurity ? Up to where can you climb
the ladder from detective, preventative or even predictive controls?
• How does it learn ?
• Learning ‘on the job’ within the user’s environment or the provider’s ?
• What volume of data is required ? How often is retraining needed ?
• What's the mechanism for collaboration with human ranking ?
• What are the error rates ?
• False positive, and false negative
• Is the error rate acceptable to achieve detection ? Automatic
remediation ?
• Can it detect, cluster, classify and make predictions that
• (complexity) would not have been possible by humans alone, and
• (scale) reduce the amount of human intervention and analysis
required,
• (latency) in a timeframe not achievable by humans only ?
• Consider the risks of an AI solution - AI security is still nascent, as its
control framework
• Data input validation issues are not uncommon
• What are the risks of DL models ? Of black box proprietary
solutions?

SO WHAT ?
Takeaways for the
ordinary CISO

What conclusions for your
cybersecurity strategy ?
• Stressed and stretched IT security teams look to automation of
cybersecurity tasks for relief
• Orchestration and integration of existing cybersecurity solutions is also
necessary
• Scarcity of cybersecurity experts look for support from augmented (AI to
support humans) if not autonomous intelligent (AI without humans) to
increase efficiency, and be able to meet more complex, massive and time
sensitive threats
• Evolution of the role of cybersecurity staff
• Use the complex enterprise context to ascertain the results of AI systems
• Human intervention will most probably be required to provide specific
expert knowledge or when an action can have severe consequences
• AI solutions should be fully integrated and consistent with the existing
Cybersecurity and IT processes to be efficient
• Ensure cyber risk management is fully integrated into Operational Risks
• Some change management might be required to benefit fully from the
expected Innovation and quality improvement and cost reduction
• Do AI cybersecurity systems bring new risks ? Can we compensate with
existing controls or do we need to develop new ones ?
People, Process and Technology wide
Source: BDO Global

Much more work required
in this nascent field

AI
• Understand skills and training that are going to be necessary
• Enable responsible widespread use of data by defining a framework of
interoperable anonymized data
• Define a framework to assess and test AI safety
AI in cybersecurity
• Define a framework to assess use of AI by cybersecurity threat actors
• Define an AI security risk framework
• Define an associated set of AI security controls
• Define a framework to assess and test AI based cybersecurity solutions
• Define an implemental maturity model for AI based cybersecurity
solutions
Further ICON work could focus on
Across 2018 - 2019
Source: NIST AI projects

Contact us@
Olivier Busolini
busolivier@protonmail.com
This presentation was created in my personal capacity. The opinions expressed in this
document are mine only, and do not necessarily reflect the view of my employer.
All right reserved to the author.
Additionnal sources
Accenture
Autonomous Research
Cybersecurity intelligence
CSO Online
Defcon 2018 AI Village
Microsoft
NIST
Raffael Marty
Rodney Brooks
Thanks to
Reto Aeberhardt (EY)
Jan Tietze (Cylance)
Godefroy Riegler
David Doret
Fabian Gentinetta-Parpan (Vectra)

Peek into the use of AI in
Financial Services

• AI is expected to change the jobs landscape - Deleting certain jobs and
creating others – helping focus on more added value activities
• Dealing with millennials
• Jobs relying on empathy and ability to connect could be impacted by AI
- Which as a higher Emotional Quotient, AI or humans ?
• Lots of work ongoing to enhance EQ in agents
• Front desk jobs will be impacted by chatbots (caution with past
backslahes – interesting customer support results rate for Swedbank’s
Chatbot Nina), voice assistants or automated authentication
• Operations roles will be impacted by RPA (JP Morgan’s contract
intelligence platform COIN saved more 360,000 man hours of contracts
analysis)
• Finance controls and compliance roles will be impacted by AI based
Anti-Money-Laundering, Anti-Fraud, Compliance and Monitoring tools
• Credit Scoring agents extracts insights from data on contracts, past
spending and future income to provide a range of credit decisions –
particularly sensitive to bias and explainability
• Automatic advise (e.g. Financial advisers of Morgan Stanley)
• Algorithmic Trading and Investments leverage greater and more diverse
sources of information, which are feeding into trading models (e.g. Black
Rock, JPMorgan and Citibank)
AI in Banking
Some business cases

• AI explainability will most probably be required by regulations
• Accountability and reputational risks
• Error rates create reputational risk
• Might need compensating controls
• Current market adoption of AI is driven by the risk appetite of the
company, that seems to be directly related to its size and competitive
environment
• Maturity of the banking industry in cybersecurity should ease the
securisation of AI
• Most of ML is powered by exchange of data with Cloud based
technologies
AI in Banking
And attention points

Artificial Intelligence and Cybersecurity

More Related Content

What's hot

Similar to Artificial Intelligence and Cybersecurity

Recently uploaded

In this document

Artificial Intelligence and Cybersecurity