Artificial Intelligence (AI) and Cyber Security

‍

At Theta, artificial intelligence helps us to create chatbots - using natural language processing and, in the case of our FAQ bot, machine learning too. We also use a variety of machine learning tools to generate insights and predictive analysis for our analytics customers. All of which supports intelligent decision making, drives efficiencies and enhances customer engagement.

We are also interested in the potential of machine learning to enable our cyber security.

The value of perfect information

Machine learning is becoming increasingly important for cyber security. Without perfect intelligence about your adversaries, it should be impossible to tell what techniques and tradecraft they might use against you in the future. Machine learning can deliver insights into adversary behaviour that complements intelligence derived through other means. It also enables much greater agility and flexibility, since AI-based tools are generally quicker to deploy and faster to deliver positive operational effects than legacy tools.

‍

The ability to detect outlying data artefacts or correlate events are the principles used by security information & event management systems (SIEM). A SIEM will ingest and correlate the large amounts of data generated by the security appliances (like firewalls) and agents across an enterprise in an attempt to detect adversary activity. The shortcoming here is that is many of the responsive activities still require a human to take action, and even then, only after the event has occurred. Wouldn’t it be better to defeat the threat before it became an incident? This is where using AI to perform the analysis and prevention in real time is powerful.

Know your enemy

Understanding the human motivations behind hacking can enlighten your network defenders about where to focus their activities. This is because hacking is ultimately a human endeavour and you are often selected as a target by a human, not a computer. The cyber kill chain doesn’t begin with reconnaissance, it begins with a motivation that drives target selection. All contemporary advice on the cyber kill chain seems to forget this crucial step in the process.

For example, a military operation would not go ahead without some understanding of the enemy’s capability, will and intent. An army wouldn’t deploy without knowledge of the terrain they had to fight through and an air force wouldn’t fly without knowing what the weather was or where the air defence missile systems were. Yet many organisations seem happy to forget about all context. They abdicate responsibility for cyber security to their IT departments, who are expected to ‘beat the bits’ against every conceivable attack and patch every vulnerability, without considering what the enemy might be up to.

Current commodity malware that targets organisations indiscriminately is usually easier to detect and defeat. More advanced adversaries present a greater danger because their motivations and targeting processes are largely hidden. Adversaries using AI to make their target selection are especially dangerous.

No hacker leaves no trace

With AI, the targeting, payload selection, weaponeering, delivery and execution could in theory be totally automated with the ruthless and efficient logic of a computer. Human hackers often get caught because they get spooked, over confident or frustrated and make ‘noise’ on the target network that gives them away. A risk-aware and AI-enabled adversary would probably not make the same mistakes and if they did they would learn very quickly.

‍

‍

Many nation-state adversaries are unlikely to go full-AI for their offensive cyber capabilities anytime soon. They are likely to retain a human in the loop to ensure proportionality and minimise the chances of collateral damage or runaway propagation of a cyber attack. The real danger is likely to either come in the form of commoditised AI frameworks which can be ‘rented’ from cyber criminals, or rogue nation-states, as we have seen with WannaCry and the Mirai botnet.

It gets worse. AI can now be used to defeat security controls such as ‘CAPTCHAs’ (security controls used to differentiate between humans and computers on webforms). While this application of AI was used to solve a unique problem, there are various frameworks such as Microsoft Azure AI platform, Google Tensor Flow, Amazon Web Services AI and IBM Watson that could be used by anyone to defeat other controls.

AI on the defensive

The good news is that AI can also be used to defeat, or at least disrupt, cyber threats.

At Netsafe, they have developed an AI chatbot to converse with scammers. If you’ve ever received an alluring opportunity via email about a lost prince trying to wire some funds through your account or a long-misplaced lottery ticket, then you can now forward the email to me@rescam.org and they will take over the conversation for you, without exposing you to any risk. By holding convincing email conversations with scammers, the chatbot consumes their time and resources, making their work less productive.

But what about defeating technical tradecraft? We have seen how rapidly adversaries can rapidly weaponise opportunities such as leaked NSA hacking tools and turn them into effective ransomware. If no signatures exist for the malware being used or if the attack launched directly into memory without writing to disk, then how can the attack be detected, let alone defeated?

Machine learning and malware detection

Machine learning can examine data structures it hasn’t seen before and derive insights from them. In the case of cyber security, we take a few characteristics of both malicious and harmless files or behaviours and the plot the results on a simple X,Y chart. Red dots represent data points for malicious events and blue represents legitimate activity:

‍

There is some distinction between legitimate and harmful files, but the data is very ‘noisy’. Although there are some clusters of both good and bad, it’s nowhere near clear enough to make a classification either way.

What if we add hundreds of characteristics to the model and view the results from different angles?

‍

‍

Now we have a slightly better view of the distinction between good and bad files, but it could be better. Perhaps if we cast the ‘shadow’ the data forms onto different shaped objects like spheres or saddles to accentuate the differences? Then very clear patterns begin to emerge allowing us to make a more definitive classification:

‍

Even with outlying data points it would still be possible to estimate the validity of an event, especially when considered with other behaviours being detected and correlated. Machine learning systems do this in real time without the need for vast signature libraries and without having seen the behaviours or data before. Better still, machine learning systems continuously refine their rules to make increasingly accurate assessments, and can be ‘taught’ in a more structured environment by humans about definitively good or bad situations.

This is not a mathematical fantasy. We use this technology every day at Theta and recommend it to our clients.