How AI is changing cybersecurity

Ruslan Rakhmetov, Security Vision

The explosive growth in popularity of AI systems has become one of the technological phenomena of recent years: chatbots are being integrated into applications, AI assistants significantly accelerate software development, and speech recognition systems can transcribe meeting conversations. Meanwhile, attackers are also using AI – for example, to create deepfakes and phishing, to find vulnerabilities and develop exploits, and to conduct automated cyberattacks, where most actions are performed by AI agents, with the hacker merely specifying targets and confirming critical actions. Naturally, AI technologies have also begun to be used to ensure cybersecurity – from the integration of AI assistants into traditional information security systems to the creation of new types of security solutions whose architecture is built on AI/ML. In this article, we will discuss how AI technologies are changing cybersecurity, how they help facilitate the work of information security specialists in SOCs, and how they are being integrated into SIEM, SOAR, TIP, and other solutions.

Machine learning technologies (ML) and AI have replaced traditional security architectures that were based on signatures and rules and operated within a rigid logic defined by the information security administrator. However, this approach did not provide the necessary flexibility and was unable to respond to evolving cyber threats, including the actions of organized APT groups, rapid automated attacks, and cyber espionage with long-term covert presence of attackers in compromised infrastructure. Specialists needed information security vendors and their security products to respond to changing techniques and the evolution of cyberattack tools, advanced persistence and lateral movement methods, fileless attacks, and hacks using system utilities (Living off the Land) and legitimate tools for traffic tunneling and remote device administration. Such attacks, invisible to classic information security systems, are detected by machine learning and AI methods, which make it possible to analyze huge data sets and identify attacks faster than traditional signature-based information security systems or manual human intervention. However, the active use of ML and AI technologies also carries certain threats – from vulnerability to specific attacks on data and models to incorrect conclusions and unauthorized actions. Therefore, when implementing such technologies, it is important to ensure an adequate level of cybersecurity, as well as provide a "human" expert with the ability to approve or cancel any actions (the "human in the loop" approach).

ML methods allow us to solve the following problems:

• Malware detection (including viruses, Trojans, stealers, cryptominers, etc.): ML allows you to analyze program behavior, network and file activity, APIs, and system calls to find activity for which there are no signatures or detection rules yet;

• Network attack detection (DDoS, network perimeter scanning, traffic exfiltration, connections to C2 servers): ML builds a model of normal network infrastructure behavior, analyzes network traffic and identifies deviations from the norm that may indicate an attack;

• Phishing protection: ML and NLP methods (Natural Language Processing) helps check email headers and body text, identify characters invisible to humans, analyze links for phishing, and check domain names to identify DGA domains;

• Prioritization: ML methods help move beyond classic CVSS prioritization schemes to risk-based and contextualized vulnerability risk assessment by analyzing cyber intelligence (TI) data and historical vulnerability exploitation data, as well as by analyzing network topology and infrastructure configuration to identify the most critical vulnerable assets;

• Using cyber threat intelligence data: ML and NLP techniques help scan and analyze multiple sources of cyber threat data, including unstructured reports and social media and forum posts, to extract indicators of compromise (IOCs) and attack indicators (AIs) for use in breach detection;

• User behavior analysis: ML is used in UEBA (User and Entity Behavior Analytics) which build models of typical behavior of accounts, devices, and applications in the infrastructure, and then identify deviations from patterns of normal behavior;

• Cyber incident response: ML allows you to detect signs of false positive alerts, correlate events by discovering implicit connections between them, and prioritize incidents;

• Automating the work of cybersecurity monitoring centers (SOCs): ML is used for triage and prioritization alerts, filtering out false positives, identifying anomalies and hidden correlations between events, and grouping similar incidents.

The following machine learning methods are used to solve cybersecurity problems:

• Supervised Learning, which uses labeled data sets (training data sample) and the work of a “teacher” (person or system), who trains ML to distinguish data;

• Unsupervised Learning, in which the algorithm analyzes unlabeled data without human intervention, independently identifying patterns and relationships in the data;

• Deep Learning, which uses neural networks to detect complex patterns in data and self-learn.

Machine learning is actively used in the cybersecurity industry today, but over time, AI systems have become increasingly used – for example, LLM (Large Language Models), generative AI (genAI), and AI agents. LLM models process natural language queries, genAI enables the creation of new content based on existing data and knowledge, and AI agents act as assistants for information security specialists and help perform applied tasks by interacting with various IT systems and information security tools.

The use of AI in cybersecurity offers the following benefits to cyber defenders:

• Source code analysis, search for vulnerabilities and unsafe configurations, checking the compliance of settings with various recommendations and requirements (regulatory, corporate);

• Analysis of malware and hacker tools, detection of cyber threat trends, identification of priority targets for attack and, accordingly, protection;

• Analysis of infrastructure, network settings, and connections between assets to identify likely attack routes and block them;

• Effective threat detection in massive data streams using correlation and noise filtering;

• Improving the detection of covert and complex cyberattacks through anomaly detection, pattern recognition, learning from processed events, and data contextualization;

• Increasing the speed and efficiency of response to cyber incidents using AI agents integrated with the company's IT/IS systems and external analytical services;

• Using AI assistants to support analysts, who can ask questions in natural language and receive answers from the chatbot on current threats, a specific incident, and countermeasures;

• Deep analysis of cause-and-effect relationships, determination of the root causes of incidents;

• Automation of information security reporting, including compliance with corporate and regulatory requirements for forms and templates;

• Analysis of regulatory requirements and standards, processing of incoming information (requests, notifications) from regulators.

AI systems are actively used in SOCs (cybersecurity monitoring centers), where automating manual responses not only reduces the damage from cyber incidents but also reduces the cost of scarce information security specialists for the organization being protected. AI can be used in SOCs to solve, among other things, the following problems:

• Collection and processing of arrays of unstructured information from various sources (IT/IS systems, cloud infrastructures, Internet services);

• Creation of rules for aggregation, normalization, correlation, and incident detection for SIEM systems;

• Detection of false positive and “noisy” events, reducing their number and impact on the effectiveness of identifying real threats;

• Contextualization and enrichment of incidents through the collection of information by AI agents from integrated systems and external analytical services;

• Processing security bulletins, reports on cyber threats and trending vulnerabilities, cyber threat analytics data, notifications from regulators and CERT teams;

• Scoring incidents with determination of risk, criticality, and priority of incident response;

• Support for SOC staff with an AI assistant that processes natural language queries and provides recommendations on incident response and next steps;

• Predicting the development of an attack, preventing the lateral movement of attackers and further compromise of infrastructure;

• Creating incident response scenarios depending on its type;

• Automation of incident response, execution of active actions to contain and eliminate threats using AI agents or by integrating AI systems with SOAR solutions;

• Identifying the root causes of incidents, generating final incident reports, and providing recommendations for improving infrastructure security based on processed incidents.

AI functionality is being integrated into various types of modern security solutions to improve their effectiveness, such as the following products:

• NGFW and IDS/IPS with AI modules can detect hidden network attacks and use TI data to customize detection rules;

• NDR class solutions (Network Detection and AI-powered network detection and response (NDRR) allows for the effective detection of anomalies and signs of attacks in network traffic;

• CNAPP, CASB, CWPP, CSPM and other cloud-based information security systems with AI functionality can effectively analyze arrays of data processed in clouds;

• SIEM systems with AI modules make it possible to simplify the connection of new sources and the processing (parsing, normalization) of data from them, automate the correlation and prioritization of incidents, use natural language to search through collected events, and filter out false positives;

• EDR/XDR with AI modules effectively detect anomalies on endpoints and in traffic, and are able to connect disparate events from different systems;

• AI-powered SOAR platforms simplify incident scoring, response scenario development, active countermeasures against attackers, and the generation of incident reports and reports.

ML and AI technologies are also actively used in Security Vision products:

1) Security Vision SIEM uses AI technologies to detect anomalies in collected events, identify certain typical attacks (malware, DDoS, botnets, C2 connections, lateral movement, etc.), detect the execution of malicious commands or user actions, and triage (analysis, classification, and prioritization) incidents. Upcoming Security Vision SIEM releases will feature automatic event normalization and automatic correlation rule generation.

2) Security Vision TIP uses AI technologies to identify phishing and suspicious domain names or URLs generated using Domain Generation Algorithm (DGA) or mimicking well-known domains, as well as for detecting typical types of attacks, for detecting the execution of malicious commands or user actions, for automatically processing security bulletins and associating them with indicators of a specific detection.

3) UEBA product uses AI technologies to identify anomalies and deviations from the typical behavior of various entities (devices, accounts, applications, artifacts, etc.) in the infrastructure, to detect typical attacks, and to detect the execution of malicious commands or user actions.

4) Security Vision SOAR uses AI technologies to identify and reduce false-positive incidents, search for similar incidents and suggest effective resolution methods, retrieve indicators of compromise from security bulletins and link incidents to bulletins and APT groups, and perform incident scoring (a comprehensive assessment). AI technologies are also used to generate a list of recommended next steps for the analyst based on their previous actions, the successful actions of other employees on similar incidents, and recommendations and best Russian and international information security practices. Security Vision SOAR includes an AI assistant that answers questions about a specific incident (for example, what happened, what analysis is required, and what to do next), and can also answer general questions about cybersecurity and information security terminology. Security Vision SOAR utilizes dynamic response scenarios (a Security Vision know-how) that enable automated incident response through integration with IT/IS systems. Dynamic playbooks automatically adapt to specific cyber incidents and take into account the properties of information security events, the attributes of attacked assets and users, and the attack techniques and tools used, while simultaneously visualizing attack chains and providing specialists with expert response recommendations using our proprietary object-oriented approach. Future releases of Security Vision SOAR will feature automated incident dispatching and automated response scenario generation.

5) In the Security Vision AM AI technologies are used to assess the reachability of assets by attackers and for asset scoring.

6) VS / VM product uses AI technologies to assess the criticality of vulnerabilities based on their applicability to the infrastructure, enriching vulnerabilities with information about probable attack chains associated with them in the infrastructure.

Furthermore, the Security Vision platform automatically builds an attack chain by performing a retrospective analysis of the incident's vicinity, collecting additional data directly from the affected objects, and offering a comprehensive object-oriented response scenario unique to each event sequence and the objects involved. The Security Vision platform supports the generation of incident reports with information and summaries of completed actions and presents incidents in an interactive graph and table format, enabling direct investigation and response. The solution enables the detection of multi-stage incidents by performing a retrospective analysis of the incident's vicinity and enriching the incident with data from external analytical services and additional data directly from the affected objects. It also enables the detection of complex, undetectable attacks through an anomaly detection mechanism. The Security Vision platform supports the presentation of incidents and attacks as an interactive graph, which allows you to evaluate the attack as a whole, displaying the entire attack chain and all objects affected by it, including revealing non-obvious relationships, and also helps conduct deep analytics (through enrichment and sigma queries) and perform investigation and response directly from the graph.