AI in Cyber-security: Examples of Algorithms & Techniques Tapati Bandopadhyay

The world of AI Tools, Orchestration & Robotic Process Automation Complex task, Invasive (not ported across platforms), modifications requires changes in code, set of instructions to perform simple tasks Orchestration: work-flow driven, Semi-invasive (Needs integration) RPA: Fixed rules based, Non-invasive (works without customizations), Easily scalable, best fit for business process automation Cognitive (supervised machine learning) NLP – training with annotated/ labelled corpus, ontologies, basic sentiment analysis, bagging/ boosting, Bag of Words, Word2Vec Forecasting: ML toolboxes, predictive analytics, time-series- ARIMA, MDP, Bayesian networks, Semantic Knowledge Models Pattern recognition: Random forests, NN- CNN/ RNN, recommendation engines & classifiers [most common use-cases], clustering Deep learning, Unsupervised learning & other advanced ML Context Aware, Deep learning from observations, reasoning based advance decision makings and problem resolutions LSTM, GRU, HTM, reinforcement learning, transfer learning, explainable AI- LRP/ LIME, Meta-learning, GAN, TOMNet Machine vision, 3D extrapolation, Capsule networks, I2A algorithms

New types of Malware & Preventive Systems -1 Generative Adversarial Network MalGAN: Generate adversarial malware examples, to bypass black-box machine learning based detection models. Uses a substitute detector to fit the black-box malware detection system. Trained to minimize the generated adversarial examples’ malicious probabilities predicted by the substitute detector. Better than gradient based adversarial example generation algorithms - decrease the detection rate to nearly zero, make the retraining based defensive method against adversarial examples hard to work. Generating Adversarial Malware Examples for Black-Box Attacks Based on GAN, Weiwei Hu and Ying Tan fweiwei.hu, ytang@pku.edu.cn

New types of Malware & Preventive Systems - 2 Neural Network-based Example: MtNet multi-task, deep learning architecture for malware classification for the binary (i.e. malware versus benign) malware classification task. trained with data extracted from dynamic analysis of malicious and benign files. improvements using multiple layers in a deep neural network architecture trained on 4.5 million files and tested on a holdout test set of 2 million files MtNet: A Multi-Task Neural Network for Dynamic Malware Classification, Wenyi Huang and Jack W. Stokes Pennsylvania State University; Microsoft Research

Deep Sentinel: Deep learning in home security – Raw video streams Keep an eye on… AI2- MIT start-up: Unsupervised ML on raw data -detects abnormal activities- with human feedback, accuracy can reach >86% Deep Sentinel: Deep learning in home security – Raw video streams Cloudfare: IoT security – Orbit, Obert

NLP in Information Security To detect malicious code- source code vulnerability analysis To detect malicious DNS- Domain generation algorithms classifiers To detect phishing- Bag-of-Words model – phishing emails Malware family analysis- Topic Modelling