Practical AI for Cybersecurity

Ravi Das

• Publisher: Auerbach Publications
• Year: 2021
• ISBN:
  9781000349450
• Edition: 1
• Topic: Computer Science
• Subtopic: Software Development
• Index: Computer Science

The world of cybersecurity and the landscape that it possesses is changing on a dynamic basis. It seems like that hardly one threat vector is launched, new variants of it are already on the way.

IT Security teams in businesses and corporations are struggling daily to fight off any cyberthreats that they are experiencing. On top of this, they are also asked by their CIO or CISO to model what future Cyberattacks could potentially look like, and ways as to how the lines of defenses can be further enhanced.

IT Security teams are overburdened and are struggling to find ways in order to keep up with what they are being asked to do. Trying to model the cyberthreat landscape is a very laborious process, because it takes a lot of time to analyze datasets from many intelligence feeds.

What can be done to accomplish this Herculean task? The answer lies in Artificial Intelligence (AI). With AI, an IT Security team can model what the future Cyberthreat landscape could potentially look like in just a matter of minutes. As a result, this gives valuable time for them not only to fight off the threats that they are facing, but to also come up with solutions for the variants that will come out later.

Practical AI for Cybersecurity explores the ways and methods as to how AI can be used in cybersecurity, with an emphasis upon its subcomponents of machine learning, computer vision, and neural networks. The book shows how AI can be used to help automate the routine and ordinary tasks that are encountered by both penetration testing and threat hunting teams. The result is that security professionals can spend more time finding and discovering unknown vulnerabilities and weaknesses that their systems are facing, as well as be able to come up with solid recommendations as to how the systems can be patched up quickly.

Chapter 1

Artificial Intelligence

There is no doubt that the world today is a lot different than it was fifty or even thirty years ago, from the standpoint of technology. Just imagine when we landed the first man on the moon back in 1969. All of the computers that were used at NASA were all mainframe computers, developed primarily by IBM and other related computer companies. These computers were very large and massive—in fact, they could even occupy an entire room.

Even the computers that were used on the Saturn V rocket and in the Command and Lunar Excursion Modules were also of the mainframe type. Back then, even having just 5 MB of RAM memory in a small computer was a big thing. By today’s standards, the iPhone is lightyears away from this kind of computing technology, and in just this one device, we perhaps have enough computing power to send the same Saturn V rocket to the moon and back at least 100 times.

But just think about it, all that was needed back then was just this size of memory. The concepts of the Cloud, virtualization, etc. were barely even heard of. The computers that were designed back then, for example, had just one specific purpose: to process the input and output instructions (also known as “I/O”) so that the spacecrafts could have a safe journey to the moon, land on it, and return safely back to Earth once again.

Because of these limited needs (though considered to be rather gargantuan at the time), all that was needed was just that small amount of memory. But by today’s standards, given all of the applications that we have today, we need at least 1,000 times that much just to run the simplest of Cloud-based applications. But also back then, there was one concept that was not even heard of quite yet: Cybersecurity.

In fact, even the term of “Cyber” was not even heard of. Most of the security issues back then revolved around physical security. Take, for example, NASA again. The main concern was only letting the authorized and legitimate employees into Mission Control. Who would have thought that back then there was even the slightest possibility that a Cyberattacker could literally take over control of the computers and even potentially steer the Saturn V rocket away from its planned trajectory.

But today, given all of the recent advancements in technology, this doomsday scenario is now a reality. For example, a Cyberattacker could very easily gain access to the electronic gadgetry that is associated with a modern jetliner, automobile, or even ship. By getting access to this from a covert backdoor, the Cyberattacker could potentially take over the controls of any these modes of vessels and literally take it to a destination that it was not intended to.

So as a result, the concept of Cybersecurity has now come front and center, especially given the crisis that the world has been in with the Coronavirus, or COVID-19. But when we think of this term, really, what does it mean exactly? When one thinks of it, many thoughts and images come to mind. For instance, the thoughts of servers, workstations, and wireless devices (which include those of notebooks, tablets, and Smartphones such as that of the Android- and iOS devices) come into view.

Also, one may even think of the Internet and all of the hundreds of thousands of miles of cabling that have been deployed so that we can access the websites of our choice in just a mere second or so. But keep in mind that this just one aspect of Cybersecurity. Another critical aspect that often gets forgotten about is that of the physical security that is involved. As described previously with our NASA example, this involves primarily protecting the physical premises of a business or corporation. This includes protecting both the exterior and interior premises. For instance, this could not only be gaining primary access to premises itself, but also the interior sections as well, such as the server rooms and places where the confidential corporate information and data are held at. It is very important to keep in mind that all of this, both physical and digital, is at grave risk from being attacked.

No one individual or business entity is free from this, all parties are at risk from being hit by a Cyberattack. The key thing is how to mitigate that risk from spreading even further once you have discovered that you indeed have become a victim. So, now that we have addressed what the scope of Cybersecurity really is, how is it specifically defined?

It can be defined as follows:

Also referred to as information security, cybersecurity refers to the practice of ensuring the integrity, confidentiality, and availability (ICA) of information. Cybersecurity is comprised of an evolving set of tools, risk management approaches, technologies, training, and best practices designed to protect networks, devices, programs, and data from attacks or unauthorized access.

(Forcepoint, n.d.)

Granted that this a very broad definition of it, in an effort to narrow it down some more, Cybersecurity involves the following components:

■ Network security (protecting the entire network and subnets of a business);

■ Application security (protecting mission critical applications, especially those that are Web-based);

■ Endpoint security (protecting the origination and destination points of a network connection);

■ Data security (protecting the mission critical datasets, especially those that relate to the Personal Identifiable Information (PII))

■ Identity management (making sure that only legitimate individuals can gain logical and/or physical access);

■ Database and infrastructure security (protecting those servers that house the PII);

■ Cloud security (protecting the Infrastructure as a Service (IaaS), Software as a Service (SaaS), and the Platform as a Service (PaaS) components of a Cloud-based platform);

■ Mobile security (protecting all aspects of wireless devices and Smartphones, both from the hardware and operating system and mobile standpoints);

■ Disaster recovery/business continuity planning (coming up with the appropriate plans so that a business can bring mission critical applications up to operational level and so that they can keep continuing that in the wake of a security breach);

■ End-user education (keeping both employees and individuals trained as to how they can mitigate the risk of becoming the net victim).

Now that we have explored the importance, definition, and the components of Cybersecurity, it is now important to take a look at the evolution of it, which is illustrated in the next section.

The Chronological Evolution of Cybersecurity

Just as much as technology has quickly evolved and developed, so too has the world of Cybersecurity. As mentioned, about 50 years, during the height of the Apollo space program, the term “Cyber” probably was barely even conceived of. But in today’s times, and especially in this decade, that particular term now is almost a part of our everyday lives.

In this section, we now provide an outline of just how Cybersecurity actually evolved.

So as you can see, this is a chronological timeline of all of the major Cybersecurity events that have led us up to the point where we are today. Even in the world of Cybersecurity, there have also been major technological advancements that have been made in order to thwart the Cyberattacker and to keep up with the ever-changing dynamics of the Cyber Threat Landscape.

One such area in this regard is known as “Artificial Intelligence,” or “AI” for short. This is further reviewed in the next section, and is the primary focal point of this entire book.

An Introduction to Artificial Intelligence

The concept of Artificial Intelligence is not a new one; rather it goes back a long time—even to the 1960s. While there were some applications for it being developed at the time, it has not really picked up the huge momentum that it has now until recently, especially as it relates to Cybersecurity. In fact, interest in AI did not even pique in this industry until late 2019. As of now, along with the other techno jargon that is out there, AI is amongst one of the biggest buzzwords today.

But it is not just in Cybersecurity in and of itself that AI is getting all of the interest in. There are many others as well, especially as it relates to the manufacturing and supply chain as well as even the logistics industries. You may be wondering at this point, just what is so special about Artificial Intelligence? Well, the key thing is that this is a field that can help bring task automation to a much more optimal and efficient level than any human ever could.

For example, in the aforementioned industries (except for Cybersecurity), various robotic processes can b...

Table of contents

• Cover
• Half Title
• Title Page
• Copyright Page
• Dedication
• Table of Contents
• Acknowledgments
• Notes on Contributors
• Chapter 1 Artificial Intelligence
• Chapter 2 Machine Learning
• Chapter 3 The High Level Overview into Neural Networks
• Chapter 4 Typical Applications for Computer Vision
• Chapter 5 Conclusion
• Index