Artificial Intelligence in the Cyber Domain: Offense and Defense

Truong, Thanh Cong; Diep, Quoc Bao; Zelinka, Ivan

doi:10.3390/sym12030410

Cited by 84 publications

(36 citation statements)

References 68 publications

(77 reference statements)

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Machine learning methods are becoming increasingly popular in several domains, such as image and speech processing, social media marketing, healthcare, and also in cybersecurity [25][26][27]. These techniques can be separated into two main categories: supervised algorithms must undergo a training phase with a proper labeled dataset, where each sample is associated with a specific label (or class); on the other hand, unsupervised algorithms do not require a labeled dataset.…”

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

“…• Decision Tree: these algorithms are conditional classifiers composed of several nodes. The tree is inspected from top to bottom, where a given condition is checked at each node by analyzing the features of the input sample, leading to the following node [1,3,27,28]. • Random Forest: they are ensemble methods consisting of several Decision Trees, in which the output is computed after evaluating the prediction of each individual tree composing the "forest" [1,3,[27][28][29].…”

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

“…• Multi-Layer Perceptron: also known as "neural network", they are based on sets of processing units (the neurons) organized in multiple layers and that communicate with each other. The output is provided in the last layer of the architecture [1,3,27,28]. • Wide and Deep: this technique is a combination of a linear "wide" model, and a "deep" neural network.…”

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

See 2 more Smart Citations

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

et al. 2020

View full text Add to dashboard Cite

Adversarial attacks represent a critical issue that prevents the reliable integration of machine learning methods into cyber defense systems. Past work has shown that even proficient detectors are highly affected just by small perturbations to malicious samples, and that existing countermeasures are immature. We address this problem by presenting AppCon, an original approach to harden intrusion detectors against adversarial evasion attacks. Our proposal leverages the integration of ensemble learning to realistic network environments, by combining layers of detectors devoted to monitor the behavior of the applications employed by the organization. Our proposal is validated through extensive experiments performed in heterogeneous network settings simulating botnet detection scenarios, and consider detectors based on distinct machine- and deep-learning algorithms. The results demonstrate the effectiveness of AppCon in mitigating the dangerous threat of adversarial attacks in over 75% of the considered evasion attempts, while not being affected by the limitations of existing countermeasures, such as performance degradation in non-adversarial settings. For these reasons, our proposal represents a valuable contribution to the development of more secure cyber defense platforms.

show abstract

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

Section: Machine Learning For Cyber Detectionmentioning

confidence: 99%

See 1 more Smart Citation

AppCon: Mitigating Evasion Attacks to ML Cyber Detectors

et al. 2020

View full text Add to dashboard Cite

show abstract

“…For example, when vertex 1 is deleted, its neighbors N (1) = {7, 11, 13, 15} react to this deletion and traverse their neighbor list to check whether they are linked to each other, and then establish a new one. In this case, the following edges are created: (7,13), and (11,15). Similarly, when vertex 12 is removed together with its connected edge, the new edges are appeared: (7,9) and (0, 11).…”

Section: Network Self-healing Mechanismmentioning

confidence: 99%

“…Recent years have witnessed a dramatic growth in utilizing computational intelligence techniques for various domains. Based on developments of evolving trends of cyber-threat, it is reasonable to predict that cybercriminals will begin to integrate malware with artificial intelligence in general, swarm intelligence technology in particular, to create more effective attacks, as stated in the literature [10,11,12,13]. Generally, artificial swarm malware can share the collected information, speed up the process of trial and error, and leverage the specialized members of the swarms in the specific environment [8,17,14].…”

Section: Introductionmentioning

confidence: 99%

X-Swarm: The Upcoming Swarm Worm

Dao¹,

Diep²,

Zelinka³

et al. 2020

mendel

Self Cite

View full text Add to dashboard Cite

With the rapid growth of technology in the digital landscape, cybercriminals attempt to utilize new and sophisticated techniques to autonomous and increase the speed and scale of their attacks. Meanwhile, the Dark Web infrastructures such as Tor, plays a crucial role in the criminal underground, especially for malware developers' communities. It is logical to expect that the malicious actors would utilize the combination of these techniques in shortcoming time. To better understand the upcoming threat, in this manuscript, we investigate the design and mitigation of such malware. Accordingly, we introduce X-sWarm, which will be the next generation of resilient, stealthy malware that leverages the intelligent technique and the darknet infrastructures. Furthermore, we show that with the self-healing network mechanism, X-sWarm can achieve a low diameter and a low degree and be robust to partitioning under node removal. More importantly, we suggest the mitigation technique that neutralizes the nodes of the proposed worm.

show abstract