Machine Learning In Cyber Security

Ever wondered why IDS(Intrusion Detection System) and IPS(Intrusion Prevention System) works so accurately? How does a tool bypasses the Captcha system? How malwares can be detected with just a script? How real time cyber crime mapping works? Now then this all can be answered :)

What is Machine Learning?

Machine Learning is the study of computer algorithms that can improve automatically by experience and by use of data , In machine learning we build a model based on sample data that we call training data which can then be used to make predictions or decisions without being programmed to do so.It is considered that machine learning is seen as a part of Artificial Intelligence.

What is Cyber Security?

Cyber security also known as computer security or information technology security is the protection of computer systems and network from information disclosure , theft , or damage to software , hard wares or electronic data as well as disruption of services a certain company provides. Cybersecurity has a lot of sub-fields that professionals specialize in and all those fields have their major functionalities.

There has been a lot of cyber attacks and crimes performed in the past few years and also recently there has been a cyber"war-fare" of some sort between Ukraine and Russia which will be a good example of explaining to what machine learning can do in Cyber Security.

Geo Fencing

Russia has been receiving a lot of flooding requests coming from different places that made the servers that were being flooded to become unavailable or take much longer to load or disrupt the service being hosted , This attack is known as DOS(Denial Of Services) or DDOS(Distributed Denial Of Services) Attack , Giving an example of the trending tweets in twitter about mil.ru giving I'm a Teapot response which is code 418 , Basically what happened there is known as Geo Fencing it's when you set boundaries between certain areas or just to all areas , This can be done with the help of machine learning a system software programmed to understand and decide as well as know if an IP visiting the site is from the country or not and whether it's using a VPN(Virtual Private Network) to act as from the country it will detect the vendor nodes of the VPN as well as tor nodes and decide to authenticate or not.

Intrusion Detection Systems

The intrusion detection systems try to find intrusions of system, to confirm if the system is vulnerable to attack. Intrusions can be named anomalies or attacks, the abbreviation IDS can be used to refer to Intrusion detection systems, its work idea done by monitoring system activities or network. IDS currently have model where as it can go through the data of previous performed attacks methods and techniques and tactics and then try redo the attacks to prove if it's vulnerable.

Intrusion Prevention Systems

This prevents intrusions that are to be done in the system , so it first confirms if the system is vulnerable to attack and then decides upon the trained data models of previous based CVE(s) and then prevents such attacks without being programmed to prevent on the certain attack but just experiencing from the previous model which was trained.

Automating Tasks

The potential of machine learning in cyber security to simplify repetitive and time-consuming processes like triaging intelligence, malware detection, network log analysis, and vulnerability analysis is a significant benefit. By adding machine learning into the security workflow, businesses may complete activities quicker and respond to and remediate risks at a rate that would be impossible to do with only manual human capabilities. AutoML is a term used to describe the process of using machine learning to automate activities. When repetitive processes in development are automated to help analysts, data scientists, and developers be more productive, this is referred to as AutoML.

Network Risk Scoring

Quantitative methods for assigning risk rankings to network segments aid organizations in prioritizing resources. Machine Learning may be used to examine prior cyber-attack datasets and discover which network regions were more frequently targeted in certain assaults. With regard to a specific network region, this score can assist assess the chance and effect of an attack. As a result, organizations are less likely to be targets of future assaults.

Phishing

And yes I mean it , there have been traditional phishing detection algorithms but they aren't fast enough or accurate enough to identify and distinguish between innocent and malicious URLs. And to accomplish that , the models must be trained on characteristics such as email headers , body data , punctuation patterns , and more in order to categorize and distinguish the between innocent URLs and malicious URLs sent to the organization.

What's More?

What a powerful technology Machine Learning is! It is crucial to remember that, while technology is improving and AI and ML are progressing at a rapid pace , technology is only as powerful as the brains of the analysts who manage to use it:)BlackHats(malicious actors) will always improve their skills and technologies in order to exploit trending technologies used by most . To be able to identify and respond quickly to such threats that might happen any time it is important to combine the best technologies and procedures to date :)