We haven't seen much of AI being used by cyber criminals because most of the breaches that we
see are more due to the fact that the companies fail to implement best security practices or basic
security controls. However that is of course going to change as implementing AI becomes easier and
there is more saturation into the market and then we are going to look at more and more attackers
utilizing AI in their attack techniques. With that being said one of the examples of AI and one of
the utility is something that is known as Deepfake. So you have generative adversary network (GAN)
whereby you have two machine learning algorithms fighting with each other competing with each other.
You have a generator whose purpose is to generate let's say fake images which would look very real. And
you have a discriminator whose purpose is to detect the images that have been generated by
you know the generator. So, as we go into these iterations, both systems get better at learning
and detecting and cheating. And what you have as a result of it is something that is known as
Deepfake. We have started looking at extortion campaigns on the basis of attackers using Deepfake
technology to create a video or an image of a victim in a questionable manner and then of course
you know demand payments in bitcoins. That is something that is getting better - these
algorithms are getting better and therefore this is something that we are going to see for
foreseeable future. The other example would be a Microsoft Twitter bot which was
basically a victim of something that is known as machine learning poisoning.
The way these machine learning and AI algorithms work specifically is they are trained by the
use of large datasets. So for instance, in a scenario where you would like to detect
spam you would give the machine learning algorithm a set of emails that are classified as, let's say,
spam and a set of emails that are not spam. So the machine learning algorithm - what it would do -
it would find similarities between all the emails you know that are classified as spam. And then, of
course, by using multiple iterations, you would have what would be known as a black-box model.
So when the machine learning model is operational it learns from the inputs that is received. So for
instance when the Twitter bot was activated, it was learning from the tweets that people
were tweeting. Therefore it had developed some systematic bias and you know it reached a
point whereby - of course it was trained in a certain way to behave in a certain manner
- but of course, its machine learning was poisoned by the use of malicious tweets.
And therefore just started tweeting weird stuff and microsoft had to take it down.
However we haven't seen these attacks at large scale. We have seen academic research around
that, but we are yet to see it at the large scale because of course, it requires a lot of resources,
and there are better and much easier ways to receive spam filters. With that being said AI is
being used by the defenders mostly - cyber security companies are using AI and machine learning
to detect attacks. Security incident, even management tools, such as a logarithm, QRadar, Darkside -
solutions like Dark Trace and CISCO Stealthwatch using a combination of supervised and unsupervised
machine learning algorithms to detect anomalies in your network. These days it's very difficult to
create a product that would give the customers real world value in terms of protecting their
assets if it's not using AI or machine learning. For example, if you're an antivirus company
and you are collecting hundreds of thousands and even millions of virus samples every day,
it's not possible that those virus samples could be analyzed by human experts. So therefore you
develop machine learning algorithms to detect the new samples and train your model accordingly.
Now anti-virus is one example. So, next generation firewalls are have started to use machine learning
algorithms. We have more and more SIEM solutions - dubbed as next-generation SIEM solutionsm - using
AI and machine learning. We have endpoint detection response systems using machine learning. So, I mean,
having machine learning does not mean it solves your problem because the efficacy of the machine
learning algorithm depends upon the data set that it has been used to train and its exposure
to multiple environments. A lot of these machine learning models are trained using smaller subset
of test data not the real world data. So what it means is that, when it is exposed to the real world
environment it produces a lot of false positives. And of course, if it is producing false positive, it
has classified something as a malicious critical attack whereas it isn't. Of course, it is going to
wake up your CISO at 3am in the morning. So that is, of course, been the problem with a lot of
these tools that are claiming that they are using machine learning algorithms but their models are
not well trained. And cyber security data is a very difficult data because if you look at subsets and
data sets like weather forecasting and Forex dataset, these are very complex data sets and the
AI is not that efficient. The same is the case with cyber security. However, we have seen a lot of AI
being used in EDR - endpoint detection and response systems - whereby they have been pretty successful.