This paper discusses the role of artificial intelligence in cyber attacks. Because of all the specifics that AI technology brings with it, what is characteristic of it is its relationship with cyber risks. AI technology has a twofold efect on cyber security: it can threaten it, and it can also contribute to it. This paper discusses the role of artificial intelligence in cyber attacks. It also talks about machine learning and some of the methods, as well as deep learning methods. Here, various researches are analyzed and the best artificial intelligence methods are presented when it comes to cyber security.
tems become more flexible and efective, which involves adapting to changes in the environment to reduce the impacts that have occurred.
Recently, researchers have presented several researches in the field of artificial intelligence and cyber security. some of them only focused on adopting machine learning methods for cyber problems while other research remained focused on deep learning methods. In addition, there is a lack of literature dealing with nefarious uses of AI.
Cyber security is the development of defensive strategies that protect computer assets, networks, data and programs from unauthorized access, alteration or destruction. Due to the great advancement of information and communication technologies, new cyber security threats are emerging and changing rapidly. Cybercriminals are adopting new techniques that make their attacks faster and more extensive.
Thus, there is a demand for more adaptable and compact cyber defense systems that can detect a wide range of threats in real time. In recent years, the adoption 2. The Impact of Artificial of artificial intelligence (AI) techniques has grown and Intelligence on Cyber Security continues to play an essential role in detecting and preventing cyber threats. While the AI agenda was proposed Defining AI can have two approaches. First, it is a sciin the 1950s, it has grown rapidly in recent years and now ence that seeks to develop intelligent machines in which afects all forms of communities and occupations. scientists apply information, decision, logic and learning
This trend also afects the field of cyber security where to make machines intelligent and able to think, learn,
artificial intelligence is used for both attack and defense decide and act while trying to solve a problem, just as it
in cyberspace. Many fields benefit from artificial intel- does human reason.
ligence, such as natural language processing, gaming, On the other hand, scientists refer to AI as a science
education, healthcare, manufacturing and more. From that researches and develops methods to solve complex
an attack perspective, cyber threats can use artificial in- problems that are impossible to solve without adopting
telligence to improve the excellence and scale of their intelligence [
From a defense point of view, artificial intelligence is real-time analysis and decision-making based on huge used to improve defense strategies, so that defense sys- amounts of data. In recent years, AI has led to advances in many scientific and technological fields, such as computerized work, natural language processing, expert systems, image recognition, and more.
The rapid development of computer technology and the Internet has a significant impact on people’s daily life and work. however, it has also created many new cybersecurity problems: First, the proliferation of data means that new, short-lived species and highly adap- builds a baseline of what is normal. From there, any tive threats are becoming quite normal. Third, threats deviations can be observed to detect attacks. currently threaten various propagation, infection, and Artificial intelligence techniques are an emerging area evasion techniques; therefore, they are dificult to predict of research that improves security measures for cyand detect. berspace.
It takes a lot of time, money and efort to produce and Many AI methods are used to deal with threats,
includimplement an algorithm. also, hiring or training people ing intelligent agents, neural networks, computational
in this field is dificult and expensive. many deviations intelligence, artificial immune systems, data mining,
patand threats occur and continue to spread. so artificial tern recognition, ML, DL, and others. However, among
intelligence based methods are expected to keep pace these techniques, ML and DL have recently attracted
with these cyber security issues [
Based on its large automation and data analysis capabilities, AI can be used to analyze large amounts of data with accuracy, speed and eficiency. An artificial intelli- The advantages highlighted above are only a fraction of gence system can use existing information and recognize how artificial intelligence can help cyber security, but threats from the past to identify similar attacks in the the application of this technology has some limitations. future, even if they change. artificial intelligence has Datasets: Creating an AI system requires a significant several advantages when it comes to cyber security in number of input samples, and obtaining and processthe following aspects. ing the samples can be time-consuming and resource
AI can detect new attack changes: Conventional tech- intensive. Resource Requirements: Building and
mainnology mostly relies on known attackers and attacks, taining the underlying system requires a tremendous
while leaving room for blind spots when detecting events amount of resources, including data, memory, and
comin new attacks. The limitations of old defense technology puting power. the qualified resources necessary to
impleare now being addressed through intelligent technology. ment this technology require significant costs [
For example, privileged activity on an intranet can be False alarms: Frequent false alarms are a problem for
monitored, and any significant mutation in privileged users because they disrupt business by possibly delaying
access operations can indicate a potential threat. If the any necessary response and generally afecting eficiency.
detection is successful, the machine will become more The fine-tuning process is a compromise between
reducsensitive to detecting similar patterns in the future. With ing false alarms and maintaining a level of security.
more data, the machine can better learn and adapt to Attacks on AI-based systems: Attackers can use
vardetect faster and more accurate operations [
This is very useful as cyber attacks become more so- adversarial inputs, model theft, and data poisoning. One phisticated and hackers develop new and innovative ap- important aspect to consider is the nefarious use of AI. proaches. This technology will also be used as a way to improve
AI can handle large volumes of data: AI can improve threats. For example, malicious actors can use ML technetwork security by developing autonomous security niques to generate a variant of malware that is dificult systems to detect attacks and respond to breaches. The to detect at machine speed. artificial intelligence could amount of security alerts that appear every day can be better personalize the phishing scheme and increase the overwhelming for security groups. scope of the attack, making the attack more likely to
Automated threat detection and response has helped succeed [
This is where artificial intelligence can help by expand- a core concept of AI. In addition, section presents a brief ing the monitoring and detection of suspicious activity. introduction on ML, DL, and bio-inspired computational
An AI security system can learn to respond better to methods frequently used in the field of cybersecurity. threats: AI helps detect threats based on application behavior and network-wide activity. An AI security system learns about regular network trafic and behavior and
AI is a branch of computer science that seeks to produce a
new type of intelligent automaton that reacts like human
intelligence. in order to achieve this goal, machines must
learn. To be more accurate, we need to train the
computer using learning algorithms. learning algorithms help
improve task performance through experiential training
and learning. so far there are three main types of learning
algorithms we use to train machines:
to ML methods, DL methods also have supervised
learning, unsupervised learning, and assisted learning. Typical
DL algorithms often used in the cyber security domain
are: Feedforward Neural Networks (FNN), Recurrent
Neural Networks (RNN), Complex Autoencoders (SAE),
Generative Adversarial Networks (GAN), Restricted
Boltzmann Machines (RBM), Convolutional Neural networks
(CNN), deep belief networks (DBN) and ensemble DL
networks (EDLN) [
These learning algorithms are often used as a clas- Bio-inspired computing is a branch of AI that has been
sification engine or a regression engine. one of the most studied in recent years. It is a collection
• Unsupervised Learning: Unlike supervised of intelligent algorithms and methods that adopt
biolearning, unsupervised learning algorithms use inspired behaviors and features to solve a wide range of
unlabeled data sets for training. These ap- complex academic and real-world domain problems.
proaches are often used for data clustering, den- Among many biologically inspired methods, the
folsity estimation, or dimensionality reduction. lowing techniques are most commonly used in the cyber
security domain: Ant Colony Optimization (ACO),
Parti• Reinforcement Learning: Reinforcement learn- cle Swarm Optimization (PSO), Evolutionary Strategies
ing is a type of learning algorithm that learns the (ES), Genetic Algorithms (GA), and Artificial Immune
best actions based on rewards or punishment. Re- System (AIS) [
Machine learning (ML) is a branch of artificial
intelligence that aims to strengthen systems by using data to
learn and improve without explicit programming. ML has Recently, scientists have proposed numerous techniques
strong ties to mathematical techniques that enable the that used AI methods to detect or categorize malware,
process of extracting information, drawing conclusions phishing, network intrusion detection, and spam attacks;
from data, and discovering patterns. There are diferent counter Advanced Persistent Threat (APT); and identify
types of ML algorithms, but they can be classified into domains generated by Domain Generation Algorithms
three main categories: unsupervised learning, supervised (DGA). This part divides the literature into four main
learning, and assisted learning. In the field of computer groups: malware identification; network intrusion
desecurity, standard ML algorithms are decision trees (DT), tection; phishing and SPAM identification; and others,
support vector machines (SVM), association rule (AR) which compromises the fight against APT and the
identialgorithms, ensemble learning (EL), k-means clustering ifcation of DGA.
and principal component analysis (PCA), Bayesian
algorithms, k-nearest neighbor (KNN), random forest (RF) 4.1. Malicious Software Identification
[
Deep learning (DL) is a subfield of ML and uses data to teach computers how to do things that only humans are capable of. His motivation lies in the working mechanisms of the human brain and neurons for signal processing. The core of deep learning is that if we construct more extensive neural networks and train them with as much data as possible, their performance continues to increase.
The most important advantage of DL over conventional ML is its superior performance on large datasets. Similar Malware is a general term for many types of malicious software, such as viruses, Trojan horses, exploit worms, retroviruses, botnets, and today, malware is a popular method of cyber-attack. The impact of malware on digital society is very large, so much research has been done on adopting AI techniques to prevent and at least mitigate malware. The latest contributions use intelligence to detect and prevent malware.
The proposed method used logistic regression,
support vector machine and random forest classifier and was
run on the RIPE benchmark suite for experiments. The
authors in [
Meanwhile, scientists have presented a framework for Al-Yaseen et al. [
Another approach used operation codes (OpCode), k- sampling-based method for an intrusion detection
sysnearest neighbors (KNN), and support vector machine tem. The proposed methodology was confirmed through
(SVM) as ML classifiers for malware classification. Op- the KDD’99 Cup data set and obtained real performance
Code is represented as a graph and embedded in its own in terms of eficiency [
Later, Ie et al. has built a deep learning architecture for Thing to consider is the use of swarm intelligence (SI)
intelligent malware detection. In this paper, they used for IDS. Botes et al. [
A recent research trend in malware detection is fo- as C4.5 and CART , for intrusion detection. Using the
cused on mobile malware in general and Android mal- NSL-KDD datasets, their approach achieved an accuracy
ware in particular. Machine learning, along with deep of 65% and a false alarm rate of 0% [
Another research direction that attracted the attention Pipeline and industrial terrain datasets. The empirical
of scientists was the use of bio-inspired methods for mal- result showed that the proposed model is efective in
ware classification. These techniques have mainly been diferent types of attacks.
used for feature optimization and parameter optimization A clustering technique based on Fuzzified Cuckoo for
for classifiers [
Presented a phishing detection scheme called phish- ing results in terms of accuracy, precision and recall [15]. ing email detection system (PEDS), which joined neural network development and assisted learning. Their model 4.4. Other: Remove APTs and Identify achieved an accuracy rate of 98.6% and a false positive rate of 1.8%. DGA
Also introduced an anti-phishing method, which used Some existing works using AI approaches to mitigate several diferent ML algorithms and nineteen features to other types of cyber threats are presented. More specifdistinguish phishing websites from legitimate ones. the ically, the methods against APT attacks and DGA are model was found to achieve a 99.39% true positive rate. described as follows.
Another approach by Feng et al. [
A recent study he conducted introduced a real-time focus on valuable targets, such as agencies of large
corpoanti-phishing system that used seven diferent classifica- rations and government organizations, with the ultimate
tion algorithms and features based on natural language goal of long-term information theft. To defend against
processing (NLP). According to the authors, their ap- APT attacks, scientists have proposed various artificial
proach gave a promising result with an accuracy rate of intelligence techniques to deal with these cyber threats.
97.98% [
Another study built a stacking model by combining APT attacks. It can quickly react to APTs and detect an
GBDT, KSGBoost, and LightGBM using URL and HTML intrusion early on to minimize damage. Empirical results
features to classify phishing websites. The authors re- showed that the proposed system achieved a high APT
ported that their approach achieved an accuracy rate of detection rate.
98.60% [
The term "SPAM" refers to unsolicited e-mail (spam). architecture for APT detection, which was based on mulSpam can lead to inappropriate content and security tiple parallel classifiers. According to the authors, the issues. To overcome the shortcomings of these cyber proposed framework achieved high eficiency and accuthreats, scientists have recently applied various new, in- racy. telligent techniques to build spam filter systems. Explored how deep neural networks (DNNs), which
A spam categorization technique using modified used raw dynamic analysis features, could be used to cuckoo search is designed to improve spam classifica- attribute APTs to a nation-state. During evaluation with tion. cuckoo step size search was used for feature extrac- a training set containing 3200 samples, the proposed tion and SVM for classification. The proposed approach approach reached an accuracy of 94.6% [16]. was tested on two spam datasets—Bare-ling and Lemm- Burnap et al. [17] used machine activity metrics and ling—and obtained a competitive result. a feature map self-organizing approach to distinguish
Later, the research he conducted proposed a system between legitimate and malicious software. method has to filter spam Facebook messages using AI and machine shown promise for APT detection. learning based technique. PSO algorithm was adopted Another approach introduced an ML-based approach for feature selection, and SVM and decision tree for clas- called MLAPT to identify and predict APTs. According to sification. the authors, their system had the ability to predict APT
Recently, Aswani et al. [
DGA Domain Generation Algorithms (DGA) are algorithms used to create a huge number of pseudo-random domain names to hide the operator’s command and control (C & C) server and avoid detection.
Curtin et al. [18] also applied a similar approach using the generalized likelihood ratio test (GLRT) and obtained promising results.
Yu et al. [19] performed a comparative analysis of architectures based on Convolutional Neural Network (CNN) and Recurrent Neural Networks (RNN), tested using a dataset of one million domain names. The authors reported that all comparative models performed well with high accuracy rates and low false positive rates.
presented a new algorithm based on long-short-term memory (LSTM) network to solve the multi-class imbalance problem in DGA malware detection. Based on the obtained results, the proposed algorithm provided an improvement over the original LSTM.
In a recent study, IF-TF was used for DGA and a machine learning-based hidden channel detection DNS system. the proposed approach achieved an outstanding accuracy of 99.92% [20].
Another approach in proposed a framework for identifying word-based DGAs using word frequency distributions and an ensemble classifier constructed from naive Bayesian, extra-tree, and logistic regression. The authors reported that their method outperformed comparable ones [20].
The development of technology greatly facilitates our lives in the future. Every new technology that appears brings with it a huge number of advantages, but unfortunately, the disadvantages are what first catches the eye. People as people, look at everything to abuse. The same situation is with articfiial intelligence. The area that gives us so many advantages, is a very big problem for the future because of its shortcomings when it comes to privacy. Fortunately, the power of this technology is so great that it brings with it numerous solutions. The fact is that people are not suficiently informed about the risk of leaving their personal information on the Internet, regardless of the fact that no one is forcing us to do so. It is very important that the number of people working on data security solutions is higher than those who are trying to abuse it because data protection is the first wall of defense against crime of today. tection of spammers in twitter marketing: a hybrid approach using social media analytics and bio inspired computing, Information Systems Frontiers 20 (2018) 515–530. [15] H. Faris, A.-Z. Ala’M, A. A. Heidari, I. Aljarah, M. Mafarja, M. A. Hassonah, H. Fujita, An intelligent system for spam detection and identification of the most relevant features based on evolutionary random weight networks, Information Fusion 48 (2019) 67–83. [16] P. K. Sharma, S. Y. Moon, D. Moon, J. H. Park, Dfaad: a distributed framework architecture for the detection of advanced persistent threats, Cluster Computing 20 (2017) 597–609. [17] P. Burnap, R. French, F. Turner, K. Jones, Malware classification using self organising feature maps and machine activity data, computers & security 73 (2018) 399–410. [18] R. R. Curtin, A. B. Gardner, S. Grzonkowski, A. Kleymenov, A. Mosquera, Detecting dga domains with recurrent neural networks and side information, in: Proceedings of the 14th international conference on availability, reliability and security, 2019, pp. 1–10. [19] B. Yu, J. Pan, J. Hu, A. Nascimento, M. De Cock, Character level based detection of dga domain names, in: 2018 international joint conference on neural networks (IJCNN), IEEE, 2018, pp. 1–8. [20] Z. Wang, H. Dong, Y. Chi, J. Zhang, T. Yang, Q. Liu, Dga and dns covert channel detection system based on machine learning, in: Proceedings of the 3rd International Conference on Computer Science and Application Engineering, 2019, pp. 1–5.