How AI tools work in cybersecurity

Ruslan Rakhmetov, Security Vision

In recent years, domestic companies, following the global trend, have been betting on artificial intelligence to protect against cyber threats. Of course, systems based on rules and logic have long existed ( Rule - based + Expert Systems ) work as clearly defined behavior logics ( IF - THEN ). Such formulas can be found, for example, in IDS systems, in SOAR for ranking alerts and in SIEM for correlating events in real time. Now such systems are, of course, used, they are familiar, understandable, manageable, but they are increasingly combined with AI tools to speed up and simplify data processing.

There are many types of AI used in information security, each with its own tasks, algorithms and advantages. Therefore, we will highlight 3 groups and consider examples of application and how the logic of their work is structured:

   1)   Graph AI ( Graph AI ) and DBs that analyze relationships between entities including users, IP , files, processes, etc. to detect complex APTs through event chains, building an attack on a graph (e.g. Neo 4 j + MITRE ATT & CK) or reachability graph (SV AM) and the route of the intruder (SV SOAR) with lateral visualization movement on the network.

Imagine that you are looking for the shortest route from home to work, changing from one metro line to another. To understand the best way to get there, you build a route map in your head with transfers, and if there is a traffic jam or repairs somewhere, you look for a detour. Graph AIs work in much the same way, only instead of metro stations, they "draw" computers, users, IP addresses, files, and processes in the diagram. A route is, for example, an attacker’s path through an organization’s network or a reachability graph based on a company network map.

   2)   Machine learning ( ML , Machine Learning ) on structured data, algorithms that learn from labels or patterns in numerical data (logs, telemetry, network metrics, behavioral features). Models such as Random Forest, XGBoost, SVM, K - Means, DBSCAN and Decision Trees are used to detect DDoS and botnets, analyze network traffic and automatically identify malicious samples (malware classification).

Imagine that you have entered a store where a smart camera tracks your behavior: how you walk along the aisles, what you take from the shelves, how long it takes you to get to the checkout, etc. Over time, the system understands who is behaving like a regular customer and who is behaving like a potential thief. It will help build optimal logistics for customers and offer the system personalized discounts, and help catch the thief by informing the security guard about a possible incident. This is how machine learning works on structured data: it analyzes logs, telemetry, network packets and behavioral signatures and finds anomalies and suspicious patterns.

In general, in modern information security solutions, you can see how neural networks are used for behavioral analysis of user actions (UEBA), analysis of activity on endpoints (EDR/XDR) and predicting incidents based on behavioral patterns and risks (for example, the likelihood of an employee being fired due to a change in their behavior with files and email). ML models can also be divided into 2 groups depending on how they use incoming data:

   –    Unsupervised models ML ) or reinforcement learning ( Reinforcement) Learning ) that learn through reward and punishment (like in a game), or examine traffic in monitoring mode for some time to find anomalies in the future. This happens, for example, about optimizing the response strategy in simulations (MITRE Caldera), automatic management of NGFW policies or search for weak points in protection through dynamic scenarios for Red Team.

Imagine that you have a bunch of letters, and each one is already labeled: "spam" or "normal letter", AI analyzes which words, senders or headers are more common in spam, and which are only found in "correct" letters, and after some time the service learns to recognize new spam letters itself, even if it has not seen them before. This is how supervised learning works, since the initial letters were marked in advance. It's like showing a child 100 photos of cats and dogs, where under each it is written who is depicted in the pictures. The child remembers the differences and then correctly names new animals.

   –    Models "with a teacher" ( Supervised ML ) and deep neural networks ( Deep Learning ), including LSTM, GRU, CNN, trained on time series and event sequences. They can be trained on data on botnet activities, DDoS activities, malware operation and intruder actions, as is arranged in the incident management module using the results of the cyber polygon . Separately, we can highlight recommender systems (Recommender AI) that offer solutions or assessments based on previous experience and the behavior of other systems/users. For example, recommendations for responding to cybersecurity incidents are prepared (SV SOAR) and automatic updating of firewall policies/ ACLs occurs.

Imagine that you open a box where everything is dumped: wires, batteries, old toys, papers and start grouping them by similarity: wires to wires, papers separately, toys in another pile. The "unsupervised" model does not know in advance where the correct answer is, it itself finds groups, patterns, connections in the data - as if it is figuring it out as it goes. It is as if the child from the previous example began to group them himself: "all fluffy", "all with ears up", "all striped" and eventually formed two clusters of data - cats and dogs.

   3)   Large Language Models (LLM, Large Language Model) is another tool in the wide arsenal used in information security. Language models are distinguished by contextual understanding and analysis of non-standardized data. Most information security systems work with structured data: alerts, logs, correlation rules. But LLMs can analyze unstructured text, such as: incident reports, letters, darknet discussions, human descriptions of "something went wrong", etc.

There are, of course, some downsides, the biggest of which is the possibility of "hallucination", where the system confidently produces false or fictitious data if it lacks context. In cybersecurity, this can lead to false positives, incorrect reports, and response errors. The solution is data-validated architectures and RAG (Retrieval-Augmented Generation), in which the model refers only to verified sources.

Imagine a friend who has read millions of books, articles, letters, chats, and scripts, and you ask them to write a birthday greeting for grandma. Since they have read so many texts on this topic, friends can simply "generate" the text based on similar ones from memory. Your friend has not memorized each greeting word for word, but has learned to predict what words usually come next in cards and simply makes up something like: "Dear grandma, may each day be filled with light, like your smile ". This is also similar to how the keyboard on a modern smartphone works, which predicts what the next words will be in the message you are typing. And in exactly the same way, large language models work, which try to generate text based on billions of previously read texts.

Today, artificial intelligence is becoming an integral part of information security tools. Instead of a single "all-seeing" algorithm, entire ecosystems of specialized models are emerging (from graphs to language models, from decision trees to neural networks), each of which enhances a specific stage of the incident life cycle: from early detection to analysis and automatic response. Modern information security systems increasingly work as a symphony of models, where the rule, pattern, anomaly, and context complement each other, reducing the workload on analysts and accelerating decision-making.

It is important to understand that AI is not a "magic button", but a tool that requires validation, adaptation, and responsible implementation. It is the combination of expert knowledge, transparent models, and verified sources that makes the use of AI in cybersecurity not just a fashionable trend, but a real force in countering modern threats.