AI and Cybersecurity Lecture Set 8 (University of Sharjah) PDF

ARTIFICIAL INTELLIGENCE AND CYBER SECURITY LECTURE SET 08 CRs NO:1502170 INTRODUCTION TO CYBER SECURITY M5 - 214 [email protected] Dr. Saddaf Ruba...

ARTIFICIAL INTELLIGENCE AND CYBER SECURITY LECTURE SET 08 CRs NO:1502170 INTRODUCTION TO CYBER SECURITY M5 - 214 [email protected] Dr. Saddaf Rubab M5 - 221 [email protected] Dr. Khalid Javeed ARTIFICIAL INTELLIGENCE ? MACHINE LEARNING ? Artificial Intelligence: software that becomes aware of its own existence and can make thoughtful decisions. Rick Howard, CSO Palo Alto Networks Machine Learning: a software-development technique used to teach a computer to do a task without explicitly telling the computer how to do it. Sam Debrule, co-founder of the Voice of Machine Learning journal LEARNING SYSTEM MODEL Testing Input Learning Samples Method System Training TRAINING AND TESTING  Training is the process of making the system able to learn.  No free lunch rule:  Training set and testing set come from the same distribution  Need to make some assumptions or bias PERFORMANCE  There are several factors affecting the performance:  Types of training provided  The form and extent of any initial background knowledge  The type of feedback provided  The learning algorithms used  Two important factors:  Modeling  Optimization ALGORITHMS  The success of machine learning system also depends on the algorithms.  The algorithms control the search to find and build the knowledge structures.  The learning algorithms should extract useful information from training examples. ALGORITHMS  Supervised learning  Prediction  Classification (discrete labels), Regression (real values)  Unsupervised learning  Clustering  Probability distribution estimation  Finding association (in features)  Dimension reduction  Semi-supervised learning  Reinforcement learning  Decision making (robot, chess machine) MACHINE LEARNING STRUCTURE  Supervised learning MACHINE LEARNING STRUCTURE  Unsupervised learning PROGRAMMING LANGUAGE - WHY PYTHON?  So many tools  Preprocessing, analysis, statistics, machine learning, natural language processing, network analysis, visualization, scalability  Community support  “Easy” language to learn  Both a scripting and production-ready language  External libraries are also available: A very complete list can be found at PyPi the Python Package Index: https://pypi.python.org/pypi CHANGE CYBER SECURITY  SOPHISTICATED MALWARE SPREADING New infection every 3 seconds After…. 1 minute = 2,021 instances 15 minutes = 9,864 instances 30 minutes = 45,457 instances 15 WHAT IS THE ROLE OF AI/ML IN CYBERSECURITY?  Threat Detection: can help detect threats in real-time by monitoring network traffic and identifying patterns that could indicate an attack. Machine learning algorithms can analyze massive amounts of data to identify anomalies humans might miss, thereby improving the detection and response time to cyber threats.  Predictive Analysis: can use predictive analytics to identify potential cyber threats before they occur. By analyzing historical data and detecting patterns, AI can predict possible attacks and help organizations take proactive measures to prevent them.  WHAT IS THE ROLE OF AI/ML IN CYBERSECURITY? (CONTD…)  Vulnerability Assessment: can automate vulnerability assessment by scanning networks and identifying possible vulnerabilities that hackers could exploit. It also enables organizations to proactively patch vulnerabilities and reduce the risk of a cyber attack.  Incident Response and Recovery: can help organizations respond to cyber incidents quickly by automatically detecting and controlling the attack. By automating incident response, organizations can quickly isolate the affected systems, contain the damage, and prevent the attack from strewing. BENEFITS  Improved Detection and Response: can detect and respond to cyber threats faster than humans by reducing the impact of cyber attacks.  Proactive Protection: can help organizations identify possible threats before they occur, enabling them to take proactive measures to prevent them.  Automation: can automate time-consuming tasks like vulnerability assessment, incident response, and recovery to focus on higher-level tasks.  Cost Savings: by automating tasks, AI can reduce the need for human resources, which helps reduce the cost of cybersecurity.  Continuous Monitoring: can monitor an organization’s network and systems, providing real-time insights into possible security breaches. 18  WHAT ARE THE CHALLENGES OF USING AI IN CYBERSECURITY?  Limited Understanding: can only detect threats they got trained to identify, and they may miss new, evolving or unknown threats.  False Positives: can generate false positives, leading to unnecessary alerts and consuming valuable resources for no reason.  Lack of Trust: lack the intuition and judgement of humans, making it difficult for organizations to trust them completely. CYBERSECURITY FUTURE  AI/ML analyze vast amounts of data in real-time, looking for patterns and anomalies that might indicate the presence of a cyber attack, it can help organizations to identify threats more quickly and respond to them more effectively. 20 21