AI - A Boon or a Bane to the Cyber World?

Security researchers estimate that the cost of cybercrime will outpace security spend by over 16X, reaching $2.1 trillion by the end of 2019. Because cybersecurity skills gap persists, products and services are today built with greater automation to correlate threat intelligence and determine the level of risk and to automatically synchronize a coordinated response to threats. 

 

Often, by the time administrators try to tackle a problem themselves, it is too late, causing an even bigger issue, or more work to be done. This can be handled automatically using direct intelligence sharing between detection and prevention products, or with assisted mitigation, which is a combination of people and technology working together. 

Staying ahead of today’s accelerated cybercrime trends thus requires adding artificial intelligence (AI) to an organization’s network security strategy. Billions of dollars are being poured into artificial intelligence (AI) by technology giants and it is fast becoming the go-to technology across sectors such as IT, retail, healthcare, automobile, finance and more. 

 

AI solutions are not only relevant for stopping attackers at the beginning of an attack, but they are also used to detect attackers at any point in the threat lifecycle. A prominent example is the use of machine learning for detecting malware. Going forward, it is believed that AI will play an increasing role in automatically investigating threats and remediating attacks, which are manual processes today. 

 

However, the use of AI to tamper with legitimate data has already begun. Consider, for example, the use of so-called deepfakes which use generative machine learning (ML) models to manipulate legitimate images or videos to achieve some desired (often malicious) effect. This capability will continue to expand to other domains including information security where advanced threat actors can leverage the technology to execute better targeted attacks.

“Just like any technology, AI is of dual use. AI is being used today in cybersecurity to improve defences while at the same time it offers attackers new opportunities for compromising systems.  It is clear there will continue to be improvements on both sides as attackers and defenders coevolve. It remains to be seen which side, if any, will have the upper hand in this cyber arms race,” says Jeffrey Johns, Director of Data Science, FireEye.

 

One advantage though for defenders, as pointed out by Jeffrey is that AI solutions are often based on large volumes of data with accompanying costly expenditures for compute resources and this may be a barrier of entry for certain types of attackers.

Manga Sridhar Akella, Program Manager (Global Cybersecurity Services and Operations) – Yash Technologies however believes that AI brings in substantial risks, including AI related cybercrimes. But he is also of the view that AI can be employed to defend and to attack cyber infrastructure, as well as to increase the attack surface that hackers can target. “The rapid adoption of AI and ML by global enterprises could lead to a rise in the new breed of smarter-attacks. AI initiatives present a range of potential vulnerabilities, including malicious corruption or manipulation of the training data, implementation, and configuration. AI systems are authorized to make deductions and decisions in an automated way without any human intervention. As more machine-learning or AI systems are connected to, there's a severe rise in risks.”

Opines Anshuman Singh, Senior Director, Product Management - Barracuda Networks, “Artificial Intelligence or more appropriately Machine Learning techniques are just tools. They can be used for good and for bad. One of the most dangerous uses has come out as ‘Deep Fake’, which is a technique for making fake videos which appear real and are very difficult to differentiate from real ones. Most advanced bots mimic human behaviour including how humans move the mouse pointer. ML will enable bad bots to mimic the human behaviour much more closely just like the Deep Fake for videos.”

“AI is the newest and the most influential technological advancement that is affecting businesses, industries and even economies,” says Jyoti Prakash, Country Director – Enterprise Security Business, Micro Focus India. “While machines are more efficient than humans, it is not necessary that the coming future will replace humans entirely with machines like in movies such as Terminator. AI empowers humans when it comes to mitigating risk and cyber threats. When implemented properly, AI framework can equip machine to learn & detect faster. It can then act without being handheld – this means that you don’t need to teach a machine, what is unusual and uncommon in the environment.”

“Cyber attackers will take advantage of AI in a similar way as businesses. AI-driven attacks will be characterised by their ability to learn and get better as they evolve,” says Rohan Vaidya, Regional Director of Sales – India, CyberArk. “This will transform the ‘advanced attack’ into the commonplace, and will drive a huge economic spike in the hacker underground. Attacks that were typically reserved for nation-states and criminal syndicates will now be available on a greater scale.”

 

According to Surendra Singh, Senior Director & Country Manager – Forcepoint, there isn’t real AI in cybersecurity; there are machine learning algorithms that provide generalized insights – which is helping security experts to make decisions. “However, even for a machine learning system to work well, we need right sets of data to train the system which is fair and without bias and have the right human brain power to make sense of that data. Essentially, it’s more about the right data sets in terms of quantity and quality.” 

 

He further says that there is cyber skills shortage (estimated to be 3.5 mn by 2021) and number of breaches are continuing to rise; these factors are compounding the problems of organizations,  pushing them to seek AI based cybersecurity solutions (estimated 14X increase in the number start-ups developing AI systems since 2000), but there lies in the risk for organizations. 

 

“AI will be a critical technology for organizations to stay on the top of cybersecurity, managing the large number of alerts which SIEM generates or detects through behavioural analytics. But Artificial Intelligence can be utilized in a more efficient way if there are better-skilled professionals to handle it,” says Rakesh Kharwal, Managing Director- India/South Asia & ASEAN, Cyberbit.

 

“It is true that AI potentially has become a strong tool in the hands of cyber criminals. There have been instances recorded globally of hackers using AI technology to hack into important accounts, breach into systems and steal sensitive data. At the same time, security professionals are increasingly using AI to predict malicious attacks and cyber threats. It can be thus described as a cat and mouse game, with both cyber criminals and cyber security experts using AI to their best advantage,” says Venugopal N, Director of Security - Engineering, India, Check Point Software Technologies (India).

 

AI helping solve cyber crimes 

AI has its own advantages. As a predictive analytic tool, AI can detect if anything unusual is taking place in the system and send out alerts to prevent any kind of breach. “With the tactics of cyber criminals becoming more complicated and sophisticated, the role of AI in cyber security will gain an even bigger importance. It can also do away with many loopholes that might exist in the system or network. Also with machines becoming more intelligent and human intervention reducing, it is the organization that has to decide of how AI can be put to best use,” states Venugopal.   

 

AI & ML technologies will be a double edged sword in the cyber security space, according to Rohan Vaidya. Cyber security vendors have started using these technologies to accelerate their efforts to identify, respond to and remediate the attack vectors. On the other hand the bad guys now are able to create advanced attacks. “We have seen in some cyber attacks that the advance attacks would not have been possible unless the bad guys were not using AL & ML,” says Rohan.

 

Nonetheless, AI is changing the technological landscape. In the world of cybersecurity, it plays a major role in detecting cyber attacks at an early stage or anticipates even before they occur. “AI algorithms examine data traffic, access and analyse any abnormalities in data patterns. If something unusual is detected, the AI programs can easily look at the data to determine if there is a security breach in the system,” explains Riyaz Tambe, Director - Sales Engineering, India & SAARC – Palo Alto Networks. “As the threat landscape becomes more complex, the role of AI in cybersecurity will increase substantially to help organisations keep up with cybercriminals’ tactics, which is becoming more sophisticated.” 

 

He further continues, “Many businesses find it difficult to manually manage and analyse the volume of data generated by the cybersecurity tools they have. Hence by implementing the right tools to automate these steps, high-risk threats can be detected and prioritised much more effectively.

 

When combined with human efforts, AI can be used to bridge the gap in an organisation’s cybersecurity practice. Today, the organisation needs to recognise what machines do best and what people do best. Advances in AI can provide new tools for threat hunters, helping them protect new devices and networks even before a threat is classified.”

 

ML can often be used to build out fake information that would be difficult to differentiate from real data which would lead to all associated issues where the sanctity of a document comes into question. In such situations mechanisms, as Anshuman suggests, Blockchain could be utilized to ensure that there is a chain of evidence on the changes of important pieces of information like financial records, land records and so on. 

“Numerous computing methods of AI, including Neural Networks, Machine Learning, Data Mining, pattern recognition, and more are being leveraged in cyber-crime detection and prevention. During the usage, or prediction phase, no machine learning system is 100% accurate. So it is important that systems build in mechanisms to check for false positives or false negatives. For example, ML is being deployed in banks to predict if a borrower will pay back the loan they are taking on. If we don’t put human checks into the loop there will be multiple scenarios where a deserving candidates do not get the loan because of false positive/negative,” explains Anshuman.

 

AI – a tool for cyber criminals

Surendra says that there are several ways hackers can render AI algorithms useless for e.g hackers who get access to a security firm’s systems could corrupt data by switching labels so that some malware examples are tagged as clean code. “In some cases, hackers don’t even need to tamper with the data; instead, they could work out the features of code that a model is using to flag malware and then remove these from their own malicious code for algorithm not to catch it,” he says.  

 

Criminals often leverage Machine learning poisoning to circumvent the effectiveness of AI. This includes in-depth analysis on how the machine learning process works, which differs on a case-to-case basis, and once vulnerability is spotted, they will try to confuse the underlying models. It is not difficult to manipulate the machine learning (ML) engine if the underlying data pool is poisoned from which the algorithm is learning. 

 

“Also, attackers employ a covert technique invisible to naked eye called perturbation, which can be a misplaced pixel or a white noise pattern that can convince a bot that some object on an image is something else,” adds Manga Sridhar Akella. “Chatbot-related Cybercrimes are just one another way. AI-based chatbots could automate ransomware.”

 

Some phishing attacks also leverage social engineering to acquire information about their targeted users illegally. Social engineering is a popular kind of attack technique that uses deception to manipulate individuals to get their data.

 

“Artificial Intelligence could be leveraged for nefarious activities such as the creation of an ever-evolving malware designed to infiltrate computer networks,” points out Rakesh Kharwal. “The other potential threats include social engineering attacks, hacked and weaponized autonomous vehicles, theft of sensitive data from government and private organizations, political interferences such as misinformation campaigns, and much more. We have seen a plethora of botnet attacks and machine learning-based TTPs including TaskRabbit, Nokia, WordPress, Marriott scam, and many more, wherein AI botnets help attackers in gaining access to devices and performing attacks without getting caught.”

 

“As AI is growing at a rapid pace, organisations are now worrying about the hijacking of AI,” alerts Riyaz Tambe, Director - Sales Engineering, India & SAARC – Palo Alto Networks. “Today, hackers use the same techniques and systems like organisations do to compromise important data. We have seen that in some cases hackers have successfully been able to pull this off. Catching them is becoming a big challenge in the industry as they use smart techniques to their own advantage.

 

In order to ensure that advanced AI techniques and algorithm stay on the side of the good guys, organisations are becoming more proactive in protecting their data. Many organisations are installing advanced security systems to protect themselves against any emerging threats.” 

 

Rohan Shravan, Founder - Inkers AI points out that before credit cards, there used to be limited online frauds, but then solutions were built to tackle them. “AI will also pose new challenges, but if we have smart criminals, as have smarter engineers as well. Ultimately it is about overall pros vs cons, and I believe pros will outweigh the cons.” 

 

AI is helping make transactions safer, in detecting phishing and malware. AI algorithms are extremely proficient in examining data traffic, detecting abnormalities in transactions as well as following up with an unusual behaviour with further secondary checks. But AI is only as good as the data it is trained on. Smart criminals would figure out a new way to perform their deeds, and it would be up-to engineers to replicate their behaviour and train a newer AI model to detect that. Cyber-crimes are going to keep engineers very busy. In future, as the cost of running AI comes down, we will see AI streamline all transactions as well as its integration with block-chain. 

 

“The cybercriminal marketplace is very good at adopting the latest advances to more effectively detect and exploit vulnerabilities, evade detection, adapt to complex network environments, and maximize profitability. Adversaries will begin to leverage automation and machine learning in their attack tactics, techniques, and procedures (TTP). This isn’t a surprise, as security researchers already use sandbox tools, bolstered with machine learning, to quickly identify previously unseen threats and dynamically create protections. There is no reason why this same approach won’t be used in the other direction: for mapping networks, finding attack targets, determining where those attack targets are weak, blueprinting a target to conduct virtual PEN testing, and then building and launching a custom attack. All done at the AI level, and all fully automated,” observes Rajesh Maurya, Regional Vice President, India & SAARC, Fortinet.

 

He further continues, “One of the biggest challenges of using AI and machine learning lies in the caliber of intelligence. Cyber threat intelligence today is highly prone to false positives due to the volatile nature of the IoT. Threats can change within seconds; a machine can be clean one second, infected the next and back to clean again full cycle in very low latency.”

 

He pointed out that enhancing the quality of threat intelligence is critically important as IT teams pass more control to artificial intelligence to do the work that humans otherwise would do. This is a trust exercise, and therein lies the unique challenge. “We as an industry cannot pass full control to machine automation, but we need to balance operational control with critical exercise that can escalate up to humans. This working relationship will truly make AI and machine learning applications for cybersecurity defense effective. 

 

What is not attainable is full automation; that is, passing 100 percent of control to the machines to make all decisions at any time. Humans and machines must work together. The next generation of situation-aware malware will use AI to behave like a human attacker: performing reconnaissance, identifying targets, choosing methods of attack, and intelligently evading detection.”

 

And so...
At the Cyber Security Conclave 2019 organized by VARINDIA in June, Dr. Pawan Duggal, Advocate, Supreme Court of India and Chairman, International Commission on Cyber Security Law in his speech said that a Chinese news agency launched a particular robot which happens to be the world’s first Artificial Intelligence robo which is reading, analyzing news and simultaneously giving its viewers perspective. “If this kind of a robo while on live news tends to get hacked and is misused, its potential ramification could be very alarming. This tells us that human intelligence will be crossed by the artificial intelligence by 2062. I believe those figures are wrong. The actual tipping point is going to come much earlier. No wonder Artificial Intelligence today, apart from being an opportunity is one of the biggest challenges for cyber security because on the dark net you have abilities to actually start using AI services for breaching cyber security.”

 

As all security vendors confer, there is the need to implement a holistic security framework to identify, protect, detect, respond and recover from cybersecurity threats - AI & Analytics can help only if it is implemented in the right manner. With AI being used extensively for fraud detection, companies need to up their anti-fraud tech budgets and investments for a secured Hybrid IT environment.

 

The role of AI in cybersecurity will increase substantially to help organizations keep up with cybercriminals’ sophisticated tactics. Applying AI techniques for combating cyber-crimes is useful for the detection and prevention of cyber-attacks. 

 

With swift advancements, AI helps improve cybersecurity by automating complex processes for detecting attacks and reacting to breaches. This will enhance incident monitoring, leading to instantaneous automated responses towards limiting damages. 

 

Security software vendors are expected to develop stronger ways of combining insights from analyzing the data gathered from different customers to produce a more complete and immediate understanding of the evolving threats. Also, there would be improvements expected in how easy it is to use security solutions, where more and more forensics tasks will be automated, and small findings will be jointly analyzed (correlated) and served to the analyst in such ways that the big picture insights will be immediate.    

 

Enterprises have spent trillions of dollars on purchasing and deploying cybersecurity solutions, yet attackers still enjoy a 95% success rate in targeted and advanced attacks. This massive imbalance between investment and outcomes is because organizations current approach to cybersecurity focuses more on protecting infrastructure and putting walls to keep people out, as opposed to focusing on what's happening with the people on those infrastructures. And like Venugopal points out the capabilities of AI has not yet been leveraged significantly yet in India but its usage is going to grow with time, as companies start realizing the various advantages that it offers. “It is going to play a significant role in analyzing the security landscape and offering preventive measures to curb the intensity and scale of cyber crimes,” he concludes.