AI in threat detection
In the current complicated cybersecurity scenario, threat detection is just a needle in the haystack.
We have seen malicious actors exploiting everything they can get their hands on, from AI tools, to open-source code to multi-factor authentication (MFA), the security measures should also adapt from time to time across a company's entire digital landscape.
AI threat detection, simply put is an AI that understands your needs- is essential that can businesses in defending themselves. According to Toby Lewis, threat analysis head at Darktrace, the tech uses algorithmic structures that make a baseline of a company's "normal."
After that, it identifies threats, whether it's new or known, and in the end, makes "intelligent micro-decisions" about possible malicious activities. He believes that cyber-attacks have become common, rapid, and advanced.
In today's scenario, cybersecurity teams can't be everywhere all the time when organizations are faced with cyber threats.
Securing the digital landscapes
It is understandable that complexity and operational risks go hand in hand as it is not easy to control and secure the "sprawling digital landscapes" of the new organizations.
Attackers are hunting down data in the SaaS and cloud applications, the search also goes to the distributed infrastructure of endpoints- from IoT sensors to remotely-used computers to mobile phones. The addition of new digital assets and integration of partners and suppliers have also exposed organizations to greater risks.
Not only have cyber threats become more frequent, but there is also a concern of how easily malicious cyber tools can be availed nowadays. These tools have contributed to the number of low-sophistication attacks, troubling chief information security officers (CISOs) and security teams.
Cybercrime becoming a commodity
Cybercrime has become an "as-a-service" commodity, providing threat actors packaged tools and programs that are easy to install in a business.
Another concern is the recently released ChatGP by OpenAI. It is an AI-powered content creation software that can be used for writing codes for malware and other malicious activities.
Threat actors today keep on improving their ROI (return on investments), which means their techniques are constantly evolving, and security defenders are having problems predicting the threats.
AI heavy lifting
AI threat detection comes in handy in this area. AI heavy lifting is important to defend organizations against cyber threats. AI is always active, its continuous learning capability helps the technology to scale and cover the vast volume of digital assets, data, and devices under an organization, regardless of their location.
AI models focus on existing signature-based approaches, but signatures of known attacks become easily outdated as threat actors constantly change their techniques. To rely on past data is not helpful when an organization is faced with a newer and different threat.
“Organizations are far too complex for any team of security and IT professionals to have eyes on all data flows and assets. Ultimately, the sophistication and speed of AI “outstrips human capacity," said Lewis.
Detecting real-time attacks
Darktrace uses a self-learning AI that is continuously learning an organization, from moment to moment, detecting subtle patterns that reveal deviations from the norm. This "makes it possible to identify attacks in real-time, before attackers can do harm," said Lewis.
Darktrace has dealt with Hafnium attacks that compromised Microsoft Exchange. In March 2022, Darktrace identified and stopped various attempts to compromise the Zobo ManageEngine vulnerability, two weeks prior to the discussion of the attack publicly. It later attributed the attack to APT41- a Chinese threat actor.
War of algorithms- using AI to fight AI
Darktrace researchers have tested offensive AI prototypes against its technology. Lewis calls it "a war of algorithms" or fighting AI with AI.
Threat actors will certainly exploit AI for malicious purposes, therefore, it is crucial that security firms use AI to combat AI-based attacks.
