Overview of Artificial Intelligence in Cybersecurity

Editor's Notes

• #10: Malware creation: Customized undetectable malware using Elon Musk's OpenAI (2017 Defcon) Extension on polymorphic malware: modify code on the fly based on how and what has been detected in the environment Smart botnets Self learning botnets: actions based on local intelligence and exchanges between botnets Smarter zombies: act without the botnet C&C instructions Advanced spear phishing: text-to-speech, speech recognition, and natural language processing (NLP) for smarter social engineering Train on genuine emails and make convincing scams “Automated End2End spear phishing on Twitter”: success rate varying between 30 and 60 % (Black Hat USA 2016) Counter threat intelligence DDoS TI: raising the noise floor generates a lot of false positives to common machine learning models -> once a target recalibrates its system to filter out the false alarms, the attacker can launch a real attack that can get by the defensive ML Unauthorised access: Breaking current CAPTCHA (98% success) Poisoning machine learning engines 2017: convolutional neural networks (CNNs) attacked to produce false (but controlled) results through CNNs like Google, Microsoft, and AWS Using AI to classify victims and optimize RoI Condition based Cyberattacks e.g. Cyberattacks using Blockchain based smart contracts
• #13: Generative adversarial networks, or GANs, which pitch two neural networks against one another, can be used to try to guess what algorithms defenders are using in their AI models. Another risk is that hackers will target data sets used to train models and poison them—for instance, by switching labels on samples of malicious code to indicate that they are safe rather than suspect. Malware creation: Customized undetectable malware using Elon Musk's OpenAI (2017 Defcon) Extension on polymorphic malware: modify code on the fly based on how and what has been detected in the environment Smart botnets Self learning botnets: actions based on local intelligence and exchanges between botnets Smarter zombies: act without the botnet C&C instructions Advanced spear phishing: text-to-speech, speech recognition, and natural language processing (NLP) for smarter social engineering Train on genuine emails and make convincing scams “Automated End2End spear phishing on Twitter”: success rate varying between 30 and 60 % (Black Hat USA 2016) Counter threat intelligence DDoS TI: raising the noise floor generates a lot of false positives to common machine learning models -> once a target recalibrates its system to filter out the false alarms, the attacker can launch a real attack that can get by the defensive ML Unauthorised access: Breaking current CAPTCHA (98% success) Poisoning machine learning engines 2017: convolutional neural networks (CNNs) attacked to produce false (but controlled) results through CNNs like Google, Microsoft, and AWS Using AI to classify victims and optimize RoI Condition based Cyberattacks e.g. Cyberattacks using Blockchain based smart contracts
• #14: Adversarial inputs — big data inputs developed to be reliably misclassified by AI technologies to allow threat actors to evade detection. This category includes malicious documents and attachments designed to evade spam filters or antivirus technologies. Data poisoning — the method of feeding “poisoned” training data to cybersecurity tools. Poisoning attacks can occur when data is fed to a classifier to skew the machine learning model’s ability to distinguish adverse events from normal events. Feedback weaponization — a method of data poisoning that tricks a machine learning model into generating an enormous volume of false positives to create excessive noise in the SOC and evade detection. Model stealing — an attack that incorporates techniques used to create a duplicate of a machine learning model or steal model training data. This methodology can be used to steal AI models used to classify incidents, events and malicious content. Stealing models enables bad actors to develop sophisticated, highly targeted attacks against cybersecurity AI.