Artificial intelligence in information security

Ruslan Rakhmetov, Security Vision

The speed of development and changes in cyberspace in the last 3-5 years amazes not only inexperienced users, but also venerable IT and IS specialists. It is not even the volume of data processed, the number of devices or applications/services connected to the Internet, but the concepts and technologies themselves that are evolving exponentially, while comprehensive digitalisation and the shift of most businesses online due to the pandemic have only accelerated this trend.

This speed is due, among other things, to the development of tools for creating new technologies and new and better tools, which entails further acceleration of the creation of already new technologies and tools. The widespread use of high-level and ultra-high-level programming languages, powerful frameworks and development environments, the development of cloud infrastructures and virtualisation and containerisation technologies make it possible to ‘build’ a new application in an unprecedentedly short time. Cyber threats are multiplying at the same rate, as attackers use the same high-performance development tools, but for their own purposes. This brings the level of cyber countermeasures to a new level: whereas previously the confrontation with attackers could be described as a battle of wits and customised information security tools, now it can be called a full-fledged ‘war of the machines’ fought by artificial cyberintelligence.

Talks about the practical application of artificial intelligence, including in information security, have been going on for a long time, but these tools entered the market when the maturity of such products allowed them to be used in corporate environments, the accuracy of their work began to justify their cost, and the capabilities of attackers became so broad that it became possible to effectively and promptly counter them only with the use of this technology.

If we turn to history, the prerequisites for the creation of the concept of artificial intelligence were scientific research in the field of building a mathematical model of an artificial neuron and neural network based on observations of living organisms and natural neurons. In 1943, American neurophysiologists Warren McCulloch and Walter Pitts in their scientific article ‘Logical calculus of ideas relating to nervous activity’ suggested that a network consisting of artificial neurons similar to natural neurons could perform logical and mathematical operations. The outstanding British scientist Alan Turing in 1948 published the article ‘Intelligent Machinery’ (English ‘Intelligent Machinery’), and in 1950 - the work ‘Computing Machinery and Intelligence’ (English ‘Computing Machinery and Intelligence’), which describe the concepts of machine learning and artificial intelligence. The term ‘Artificial Intelligence’ itself was introduced by American computer scientist John McCarthy in 1956. It was one of the first attempts to ‘digitise’ a living organism and present a living being as a set of algorithms that can be analysed and reproduced.

Since then, science has made significant advances in the creation of artificial intelligence: landmark events include the chess victory of IBM's Deep Blue supercomputer over grandmaster Garry Kasparov in 1997 and the victory of Google's DeepMind program AlphaGo over professional player Lee Sedol in 2016. In this case, the first victory was achieved in a well-algorithmised chess game, where it is enough to know all possible combinations and moves to win, and the second - due to machine learning, which was used by AlphaGo for self-training in the game of go.

So, let's give modern definitions to a few terms related to Artificial Intelligence (AI):

- Artificial intelligence (AI) involves information systems performing decision-making and learning tasks, similar to the intelligence of living beings

- Neural network is an interconnected set of artificial neurons performing simple logical operations, which has the ability of machine learning.

- Machine learning (ML) is a technique of training an information system on the basis of provided datasets without using predefined rules, it is a special case of artificial intelligence. The general task of machine learning is to build an algorithm (programme) based on the provided input data and given correct/expected results - thus, the process of ML-system operation is divided into the initial training on the provided datasets and the subsequent decision making by the already trained system.

There are several ways of machine learning, for example:

- Supervised learning (Supervised learning) - is a method of machine learning, in which marked-up datasets (proclassified objects with selected characteristic features) are used, for which a certain ‘teacher’ (a human or a training sample) indicates correct question-answer pairs, on the basis of which it is required to build an algorithm for providing answers to further similar questions

- Unsupervised learning is a method of machine learning in which no labeled data sets are used, no correct question-answer pairs are specified, and the information system is required to find various relationships between objects based on their known properties.

- Semi-supervised learning is a method of machine learning that combines a small number of labelled datasets and a large number of unlabelled datasets. This approach is justified by the fact that obtaining high-quality marked-up datasets is a resource-intensive and time-consuming process

- Reinforcement learning is a special case of learning with a teacher, in which the ‘teacher’ is the operating environment that gives feedback to the information system depending on its decisions.

Machine learning can also use other algorithms, such as Bayesian networks, Markov chains, gradient bousting.

- Deep learning is a special case of machine learning that uses a complex multilayer artificial neural network to emulate the human brain and process speech (natural language processing), sound (speech recognition) and visual images (computer vision). Computer vision is now widely used in security systems, transport and passenger control. Natural language processing and speech recognition systems help Siri or Alice to answer users' questions.

- Big Data is a large amount of structured and unstructured data in digital form, characterised by volume, velocity and variety. Specialised software tools such as Apache Hadoop / Storm / Spark, Kaggle, NoSQL class DBMS can be used to process Big Data. It is believed that to increase business-value when using Big Data it is necessary to move from heterogeneous data to structured information and then to knowledge (information). A processed, structured and labelled dataset derived from a relevant Big Data set is a necessary (and one of the most valuable) component for machine learning in modern systems.

- Data mining - structuring and extraction of useful information from heterogeneous and unstructured data, including Big Data.

- Fuzzy logic - application of non-strict rules and fuzzy answers to solve problems in artificial intelligence systems and neural networks. It can be used to model human behaviour, for example, to narrow or limit the conditions of searching for an answer to a question depending on the context.

Having considered the basic definitions and principles, let us move on to the issue of practical application of AI systems in cybersecurity. The use of AI in cyber security is justified primarily by two factors: the need for rapid response in the event of a cyber incident and the shortage of qualified cyber defence specialists. Indeed, in today's reality, it is quite difficult to fill staffing levels with qualified IS specialists with the necessary experience, and large-scale IS incidents can develop rapidly: the count is often in minutes. If a company does not have a 24/7 shift of IS analysts on duty, it will be difficult to provide quality protection after hours without a system for rapid autonomous response to cyber incidents. In addition, attackers may perform a distraction before their attack, such as launching a DDoS attack or active network scanning, distracting cyber specialists. In such situations, an artificial intelligence-based cyber incident response system that can simultaneously process a large number of IS events, automate routine actions of IS analysts and provide rapid response to incidents without human intervention can help. For example, our IRP/SOAR Security Vision solution makes extensive use of artificial intelligence and machine learning mechanisms: the platform, trained on previously resolved incidents, will suggest to the analyst the appropriate response action depending on the type of cyber incident and its properties, will assign the optimal response team from colleagues with the most relevant knowledge, and if atypical suspicious events are detected, the system itself will create the corresponding incident and notify the IS department staff about it. IRP/SOAR Security Vision uses algorithms for predictive response to cyber incidents: the trained system can predict the attack vector and its subsequent development in the infrastructure, show trends, and then automatically stop malicious actions and advise SOC-centre analysts.

Artificial intelligence-based protection systems will be indispensable for detecting anomalies in a large number of information security events, for example, by analysing security logs, data from SIEM systems or SOAR solutions. This information, together with data from already worked and closed IS incidents, will constitute a high-quality marked-up dataset on which the system can be easily trained.

As a rule, classical systems of deviation analysis are based on some rules predetermined by operators: for example, exceeding the volume of specific traffic, a certain number of unsuccessful authentication attempts, a certain number of consecutive triggers of protection systems. Systems based on artificial intelligence will be able to make decisions independently, ‘without looking’ at the rules previously created by IS employees, which may have lost their relevance and do not take into account the changed IT infrastructure.

Anomaly detection can help to protect user data - for example, an online banking service can collect and analyse data on customer patterns to quickly identify compromised accounts. For example, if a user has been connecting to the service from a Russian IP address on weekdays during business hours and using Internet Explorer browser for the last year, then if the user is connecting from China using Mozilla Firefox browser at night, the user's account may need to be temporarily blocked and an alert sent to the user. Financial institutions can also use machine learning and artificial intelligence systems for borrower scoring, financial risk analysis, and anti-fraud systems.

Another model of using artificial intelligence systems in cybersecurity is working with internal intruders: knowing the typical behaviour of a user, the system can send a warning to IS analysts in case of a significant change in the employee's work pattern (visiting suspicious sites, prolonged absence from the work PC, changing the circle of communication in the corporate messenger, etc.). Protection systems equipped with computer vision and speech processing will be able to promptly notify security about attempts to pass through the gatehouse by outsiders or employees using other people's passes, analyse the work activity of employees using web cameras, assess the correctness of communication between managers and clients by phone.

At the same time, we should not forget that cybercriminals also use artificial intelligence-based systems: there are known fraudulent methods of using Deep fake (creating a realistic virtual image of a person) to deceive anti-fraud systems, fake voices for fraudulent calls to relatives of the attacked persons asking them to transfer money, use of telephone IVR-technologies for phishing and stealing money. The malware also uses artificial intelligence elements that allow attackers to escalate their privileges much faster, navigate the corporate network, and then find and steal data of interest. In summary, the technologies that are available to the public are being used for both good and bad, which means that the most sophisticated defences can and should be used to combat these trained cybercriminals.