Table of Contents
Machine learning is a branch of computer science aimed at enabling computers to learn new behaviors based on empirical data. The goal is to design algorithms that allow a computer to display behavior learned from past experience, rather than human interaction. It is Apple Music offering suggestions based on previous playlists, and the spam button in Microsoft Outlook (a good old example!). And today, I would like to discuss applications of machine learning in cyber security and look at how machine learning algorithms may help us to fight with cyber attacks.
Applications of machine learning in cyber security
Machine learning (without human interference) can collect, analyze, and process data. In the case of cybersecurity, this technology helps to better analyze previous cyber attacks and develop respective defense responses. This approach enables an automated cyber defense system with a minimum-skilled cybersecurity force.
According to Information Data Corporation (IDC), artificial intelligence (AI) and machine learning will grow from $8 billion in 2016 to $47 billion by 2020. As shared by Google, 50-70% of emails on Gmail are spam. With the help of machine learning algorithms, Google is making it possible to block such unwanted communication with 99% accuracy. Apple is also taking advantage of machine learning to protect its users’ personal data and privacy. Here, we cover the applications of machine learning in cyber security.
5 cyber security threats that machine learning can protect against
Spear phishing
One of the applications of machine learning in cyber security is to fight against spear pishing. Traditional phishing detection techniques lack the speed and accuracy to reliably catch all the malicious links leaving users at risk. So, the solution for the problem lies in the predictive URL classification models which are based on latest machine learning algorithms that can identify patterns that reveal a malicious sender’s emails. The models are trained to identify micro behaviors (key features) such as email headers, subsamples of body-data, punctuation patterns, etc. So, these trained models can be used to detect whether the email is malicious or not.
Cybersecurity provider Barracuda Network, Inc. developed an engine based on machine learning to analyze unique communication patterns without human interference, depending on the customer’s nature of business and requirements. As disclosed by the company, in real-time, the engine studies communication patterns for anomalous signals and the administrator is notified with the details of a spear phishing attack.
Watering hole
Hackers are going to track the sites that users visit often and are external to a user’s private network. This is the concept of a watering hole. Consider this example, suppose there is a popular coffee shop that a lot of people from a particular organization order food from. So users go into the web browser and type the coffee shop URL and place their orders. What hackers do is that they don’t access an organization’s network, but instead access the coffee shop’s website. Hence, they will exploit the vulnerabilities of the coffee shop’s website to access users’ credentials.
Machine learning algorithms can benchmark or ensure the security standard of the web application services by analyzing the path traversals of the website. It can detect whether users are directed to malicious websites while traversing through the destination path. Machine learning path traversal detection algorithms can be used to detect these malicious domains. Machine learning can also monitor for rare or extraordinary redirect patterns to and from a site’s host.
The cyber defence service provider, Paladion, developed a proprietary RisqVU platform to effectively counter watering hole attacks. It’s a combination between AI and big data analytics. A watering hole attack requires simultaneous analysis of data from proxy, email traffic, and pocket. RisqVU is a big data analytics platform applying analysis from multiple sources, such an AI-based study helps to visualize a single view of an attack.
Webshell
Webshell is a piece of code which is maliciously loaded into a website in order to allow the attacker to make modifications on the web root directory of the server. This means that full access to the database of the system is gained. If it is an e-commerce website, attackers might be accessing the database on a frequent basis in order to collect credit card information of the customer base.
Targets of web shell-using attackers are often backend eCommerce platforms. The major risk of eCommerce platforms is associated with online payments which are expected to be secure and confidential. When it comes to online businesses, system administrators expect redirected hosted payment pages that run on a payment processor’s servers to be secure. However, maliciously loaded web shells can modify the website to root transaction data through a different path. That data is being transmitted through the attacker’s own servers while passing through to the hosted payment page. This is a concurrent process. Thus, it is a myth that a website is more secure when the payment process is outsourced. It can in fact be exploited once the attacker takes control of the system and changes the process flow.
How can machine learning help? Statistics of a normal shopping cart behavior can be detected and machine learning models can be trained to identify normal behavior from malicious behavior. Identified malicious files can be executed on a monitored standalone system in order to train the model further. These machine learning algorithms can be used to pre-emptively identify web shells and isolate them from the system before they exploit the system.
Due to the nature of webshell attacks also noted as fileless attacks, cybersecurity firm CrowdStrike developed Falcon to detect filesless webshell attacks that relay on advanced vulnerabilities instead of traditional malwares.
Ransomware
Ransomware is a combination of ransom + software. It refers to any kind of software that demands any kind of ransom in exchange for the encryption key of the user’s kidnapped files. The encryption key is basically a key to unlock the locked files of the user. Locked files may be multimedia files, office files or system files that a user’s computer relies on.
There are two kinds of ransomware: File coder which encrypts (converts data into a secret code) files and lock screen which locks a computer and stops the user from using it until the ransom is paid.
Neural networks and deep learning algorithms can detect unknown ransomware if data sets can be trained to properly analyze micro behaviors of ransomware attacks. Basically, a large set of ransom files with an even larger set of clean files are required for this training process. The task of the algorithm is to find some key features for each file in the data set. Then, those features can be categorized into subsets to train the model for the acquired data set. When a ransom file attacks a system, that file can be checked against the trained model and necessary security actions can be taken before it encrypts the whole file system or locks access to the computer.
Cloud data protection firm, Acronis, developed a new level cybersecurity solution with the aim of a zero attack day. Acronis uses machine learning study to analyze scripts.
Remote exploitation
And last but not least in out list of applications of machine learning in cyber security is remote exploitation. Remote exploitation, which is also referred to as a remote attack is a malicious action that targets one or a network of computers. Through the vulnerable points of the machine or network, the attacker gains access to the system. The targets of a remote attack are to exploit and steal sensitive data from the system or to damage the targeted computer network by introducing malicious software. Remote exploitations can happen in various ways:
- Denial of service attack: This is a technique to make the server unavailable for users by flooding the servers with false client requests. It creates a huge usage spike which makes servers freeze and preoccupies them with a large number of pending requests to proceed.
- DNS poisoning: DNS servers are systems that translate human-memorable domain names like facebook.com to corresponding numeric IP addresses. DNS systems are used to identify and validate resources on the internet. Poisoning DNS servers basically means tricking them to accept falsified data origins as authentic and users who are accessing those poisoned DNS servers are redirected to sites that unknowingly download malicious software or viruses into the system.
- Port scanning: Computer ports are used to send and receive data. Port scanners can be used to identify vulnerabilities of data and gain access to control computers by exploiting those vulnerabilities.
Machine learning algorithms can be used to analyze system behavior and identify abnormal instances which do not correlate with the typical network behavior. Algorithms can be trained for multiple data sets so that it can track down an exploitation payload beforehand.
Juniper Networks is using machine learning to analyze mountains of data gathered automatically. Machine learning enables automation using algorithms to learn from data and make determinations and predictions.
Conclusion: applications of machine learning in cyber security
It’s still too early to say if cybersecurity experts will be absolutely supplanted by the machine learning technology. But people and robots have no other choice than to join forces against the constantly expanding dangers that sneak on the internet.
If you are working on a machine learning project and you need help with software development, just let us know! We would be happy to know more about it!
About the Author
Rajasimha is a PreScouter Global Scholar. He completed his MS in Industrial Management at the Texas A&M University, Kingsville and BT in Mechanical Engineering at Jawaharlal Nehru Technological University, Anantapur, India. Prior to his graduate degree, he worked in the manufacturing sector for four years. He’s interested in process improvement, automation, STEM education, sustainable energy and reducing carbon emission. Rajasimha is a versatile writer and loves writing and researching new topics like machine learning, IoT and AI.
If you like this article about applications of machine learning in cyber security, you may like:
Deep learning startups & use cases
Artificial Intelligence – in math I trust
And if you are really interested in knowing more about applications of machine learning in cyber security and other trendy topics, subscribe to Apiumhub monthly newsletter.
