Cybersecurity: who is already using (and how) artificial intelligence

 

Nowadays, the defense of a company perimeter is a lost war: the possible flaws are too numerous, and even if we had to cover all software vulnerabilities, social engineering always provides access to those who know which strings to vibrate. Fortunately for IT security managers, the time is ripe to receive valuable help from technologies that were relegated to science fiction films up to 5 years ago: artificial intelligence.

Machine learning, deep learning, and (inappropriately) AI are not new terms in the field of information security, on the contrary ... the heuristic analysis and pattern recognition engines of modern endpoint defense systems have explored the field for years, but now things are getting more interesting, and the approaches have diversified.

A striking example of "new generation help" is IBM's Watson for Security, which is presented as an advanced tool for human analysts rather than as an autonomous defense platform.

Watson is an extremely powerful platform, but it is not a surveillance tool. Its functionalities are activated by the security manager on specific events chosen among those that are brought to his attention by SIEM. Once triggered, Watson correlates an impressive amount of data and provides the human analyst with a very complete and clear picture of what has happened, saving him weeks of work. Watson's innovation is that it behaves exactly like the homonymous doctor in Conan Doyle's books: it is a very effective assistant that then leaves the analyst Sherlock Holmes to solve the mystery.

Very different, however, is the task that Darktrace has assigned to its artificial intelligence platform. While Watson becomes part of the security software framework, installing itself partly on the company's servers, Darktrace is entirely contained in a separate computer that is connected to the existing network. For the first hours, it remains in "listening mode," in order to analyze all the traffic learning its normal flows. When its analysis model is ready, the AI begins its surveillance operation, proving to be very effective in detecting anomalies. It is very simple to install, but extremely effective in detecting all the slight deviations that are caused by an electronic attack.

But in addition to finding attacks and conducting investigations, artificial intelligence also plays an important role in the prevention of unauthorized intrusion or automated collection of sensitive information. «Our antibot systems - one of Akamai's regional manager - have stored a huge amount of data on how users type passwords and how they behave when they browse websites. This way, our artificial intelligence can verify if who is visiting a page is a human being or a robot ». A series of parameters are examined, such as the path that the mouse performs to go to click on the buttons, the changes in speed in typing passwords or the duration of clicks on links, to prevent automatic systems trying to exploit stolen credentials or to draw on databases such as records or price lists. More and more the safety of users will depend on how artificial intelligence will recognize them and less from the passwords that will be inserted.