As described in a recent Motherboard article, Australian researchers were able to Easily Trick Cylance's AI-Based Antivirus Into Thinking Malware Is 'Goodware'.
Due to a bias encoded into the software via a whitelist of legitimate files, the researchers were able to trick the program by combining malicious code with legitimate gaming software. This vulnerability allowed the researchers to modify the executables’ risk scores and bypass detection with an 84% success rate for the 385 malware samples tested. Rather than focus on the bad luck of a well-intentioned vendor, the larger discussion has to do with the application of Artificial Intelligence (AI) to cybersecurity, and whether it can be successfully used to secure networks.
In the Information Security community, AI and one of its subsets, Machine Learning (ML), are big buzzwords these days. InfoSec experts are actively researching these technologies’ readiness for autonomous cybersecurity functions, and the general consensus is that AI and ML tools are still vulnerable to external manipulation:
AI and Machine Learning IDS products often don’t have a firm grasp on how easy they are to evade. While deploying one today may get you great detection, that may be very short lived.
– "Why I’m not sold on machine learning in autonomous security," CSO Online
It’s important to note that the AI and ML terms should not be used synonymously. First, let’s explore exactly what AI and ML are. Then, let’s look at how AI and ML tools are being deployed in cybersecurity, and whether they are actually fixing issues – or causing more problems for the companies that buy these technologies.
What is Machine Learning (ML) in cybersecurity?
From a security perspective, Machine Learning involves utilizing large sets of training data in order to detect aberrations from a historical “normal” in new data streams.
Thus far, the overall application of ML to problems for which the impact of a false negative is low, such as swiping left on Tinder, has been successful. It has also been successfully applied to security, with technology like User and Entity Behavioral Analytics (UEBA), which recognizes deviations such as successive authentication attempts from IP addresses located in different parts of the world: an impossible feat unless the user is connecting via VPN or proxy.
Machine Learning has been around for long enough that it is now sometimes a commodity technology, available as a plugin or add-on to security analytics solutions like the Elastic X-Pack. Even so, the most successful application of ML to security is through Human-assisted Machine Learning. In this scenario, both humans and machines pick up where the other leaves off. Machines can analyze massive amounts of data quicker than a human but cannot apply reasoning, such as understanding an attacker’s techniques and thought process. In other words, ML is most useful as a tool to help human analysts identify what needs to be investigated by a human, not a machine.
What is Artificial Intelligence (AI) in cybersecurity?
True Artificial Intelligence, on the other hand, refers to machines that mimic human cognitive functions like logic and reasoning. Thus far there is little evidence to suggest that this is actually happening. In a recent article entitled “DeepMind’s Losses and the Future of Artificial Intelligence”, Gary Marcus of Wired explained that machines tasked with deep reinforcement learning (a type of AI) “have only a shallow understanding of what they are doing. As a consequence, current systems lack flexibility, and thus are unable to compensate if the world changes, sometimes even in tiny ways.” As researchers demonstrated with Cylance, malicious actors can use this inability to compensate for change against AI by training it to “think” something malicious is benign.
Buyer Beware: AI and ML Tools for Cybersecurity
Today, machine learning does play an important role in cybersecurity, given adequately large training sets. AI technologies for cybersecurity are showing hints of promise as well.
For now, the challenge is summed best by this quote in the Motherboard article:
"Their crime is not that they coded AI poorly. Their crime is calling what they did AI."
– Anonymous Machine Learning Expert to Motherboard
While there is promise on the horizon for AI and ML, it’s important to separate the hype and overstated claims from true capabilities on any cybersecurity solution. Check out this CSO Online article for eleven questions to ask before buying AI-enabled security software, and this paper on the application of machine learning to intrusion detection before moving along much further in the quest for AI or ML cyber magic. Also consider the additional staff needed to administer and manage the technologies. Per the CSO Online article referenced above, “’A CSO who plans to incorporate ML solutions extensively should consider hiring both a data scientist and a data engineer.’"
"A CSO who plans to incorporate ML solutions extensively should consider hiring both a data scientist and a data engineer."
– "11 questions to ask before buying AI-enabled security software", CSO Online
For companies looking to mature their cybersecurity programs, I often begin with the security basics, like implementing a cybersecurity framework, conducting a risk assessment, etc. By focusing on strategic prioritization, organizations can manage cybersecurity risks with smart investments, and avoid problematic software solutions that aren’t up to par.
TLDR; Strengthen Your Security Posture Before Buying AI and ML
With true AI-based tools still in a nascent stage, their usefulness is limited to organizations with a mature security posture that have already mastered the basics. If you don’t have a solid handle on security hygiene, AI is not the wisest investment of resources.
As Critical Insight's CISO Mike Hamilton recently conveyed to CyberInsecurity News, buying AI and ML before addressing the basics is going to require hiring more people to make the technology work. And in the zero-unemployment market for these in-demand professionals, the promise of the technology becomes an expensive investment.
"If you’re not managing your vulnerabilities and training your users, you have no business buying AI. Not watching your network, you’re digging your hole deeper by buying a whole bunch of products that you’re going to have to throw people at. And ultimately you will achieve an outcome that is exactly the opposite of the one you intended. You’re just going to have to throw people at the problem that you bought technology to avoid throwing people at."
– Mike Hamilton, "Removing the Spookery from Cybersecurity," CyberInsecurity News
Instead, use a Focused Security Assessment or Gap Analysis to populate a relevant framework, like the NIST Cybersecurity Framework. This will be useful to identify strengths and weaknesses in the security program. By undertaking this strategic work first, IT leaders can make the business case for buying down cybersecurity risk, whether by lowering the likelihood that a vulnerability will be exploited, or by lowering the impact if it is. A holistic view of your cybersecurity risks will help you and your organization identify what priorities must be funded, and what can be safely ignored.
To learn more how this planning work can help you get the budget you need, read How to Get Budget for MDR: a 6-Step Guide for IT Security.
About the Author: Steve Torino is an Information Security Expert and Cybersecurity Engineer based in Boston, MA.