Defensive AI in Cybersecurity - Master's Course

CYB. Defensive AI (part 2)

• This is a Master's in Artificial Intelligence course, 2024/25 at ESEI University of Vigo.
• The course is focused on defensive AI.

AI/ML in NIST Core Functions

• AI/ML methods are employed in various cybersecurity subtasks, including detection, prediction, and response.
• These methods can contribute to several core functions simultaneously.
• AI/ML is predominantly used within the Protect and Detect functions, though they often overlap.

NIST Cybersecurity Framework Core Functions

• Identify: Asset management, business environment, governance, risk assessment, and risk management are central to this function.
• Protect: Access control, awareness & training, data security, information protection, processes, maintenance, and protective technology are crucial here.
• Detect: Anomalies and events, security continuous monitoring, and detection processes are essential to this component.
• Respond: Response planning, communications, and improvements are important to this function.
• Recover: Improvements, recovery planning, communications, and mitigation are critical.

AI/ML in NIST Core Functions (II)

• Identify: Includes asset management, business environment, governance, and risk assessment. Automated systems and processes are highlighted for risk assessment and policy enforcement.
• Protect: Features identity management, authentication/access control, awareness and training, data security, and information protection. Automated validation of security controls is a key aspect.
• Detect: Includes anomalies and events detection, security continuous monitoring, and detection processes. Automated threat intelligence sources and analysis are mentioned.
• Respond: Consists of response planning, communications, and improvements. Automated responsibility allocation and incident reporting are mentioned components.
• Recover: Covers recovery planning, improvements, communication, and mitigation. Includes aspects like automated isolation, incident characterization, and remediation.

AI/ML in NIST Core Functions (III)

• Identify: Automatic asset inventory using AI/ML clustering, vulnerability assessment using AI/ML (automatic scanning).
• Automation of vulnerability classification from descriptions using machine learning. Common vulnerabilities and exposures (CVE) database analysis by topic modeling and classification is mentioned.
• Red Team and Penetration Testing: AI/ML/RL can automate certain aspects (AutoPentest-DRL). Autonomous penetration testing using improved deep Q-Networks.

AI/ML in NIST Core Functions (IV)

• Cybersecurity Risk Assessment: AI/ML quantifies risks, assets, and vulnerabilities, using text mining for analysis of online hacker forums.
• Risk prediction: Asset criticality and forecasting is critical for comprehensive risk management, potentially using fuzzy sets.
• Threat Intelligence: AI/ML/NLP processes large threat intelligence datasets to identify and assess emerging threats and vulnerabilities.

AI/ML in NIST Core Functions (V)

• Protect: Malware detection & analysis using recurrent neural networks (RNNs), early-stage prediction.
• Phishing Detection: AI/ML/NLP identifies phishing emails and malicious links by analyzing content, sender behavior, and context. Robust ensemble models developed for filtering phishing URLs and related DNS.
• Authentication & Identity Verification: AI/ML used for biometric authentication, facial recognition, and behavioral analytics; ensuring a robust identification system.
• User and Entity Behavior Analytics (UEBA): AI/ML profiles user behavior to detect deviations from normal activity to detect potential security incidents in User and Endpoint Behavior Analytics.

AI/ML in NIST Core Functions (VI)

• Detect: Intrusion Detection and Prevention systems using AI and machine learning. Intrusion detections based on AI-powered honeypots for enhanced IoT botnet detection. Anomaly detection models applied on network traffic and various forensic data.
• Anti-fraud systems and network traffic analysis are highlighted, using AI/ML models. Detection of threat actors by analysing sentiments in hacker forums.

AI/ML in NIST Core Functions (VII)

• Respond: Security Orchestration, Automation, and Response (SOAR) – AI/ML to automate incident response, using techniques like heterogeneous security event prioritization and intelligent dynamic and isolation of ransomware attacks and mitigation.
• Automatic Incident Response: A Case-Based Reasoning approach to aid the development of response methodologies and the creation of incident response playbooks. Recommendation systems for selecting the appropriate playbook are used.

AI Applications in Cybersecurity (CCN-CERT BP/30)

• This document provides a framework for AI applications in cybersecurity, outlining AI applications for areas like threat detection, intrusion analysis, and automated responses.
• It emphasizes areas like biometric identification, improved automation, and threat intelligence.

Complementary References

• This section includes key publications on artificial intelligence for cybersecurity (including those related to literature reviews, future research directions, and specific research findings).