Abstract

Cyber attacks are increasing with many being very targeted and difficult to detect using signature based approaches. Signature based approaches are useful for detecting known threats but have weaknesses when trying to detect unknown threats like zero day attacks, mutated malware and anomalies. This paper explores the different types of AI and ML techniques that can be used for intelligent threat detection, blocking and reporting. A review of eleven AI/ML papers related to cybersecurity was undertaken with a range of different techniques including supervised classification for web attacks, tree based intrusion detection, ensemble techniques, DDoS detection, online Isolation Forest, deep learning for wireless and web intrusion detection, and general cybersecurity surveys. By reviewing the literature it has been found that using learning based approaches can increase flexibility within the system and provide real time monitoring. However there are limitations to these approaches when applied to real world cases including old and limited benchmark data sets, false positives, cost of models, class imbalance and poor integration between detection and blocking. This paper suggests an end-to-end concept framework for capturing and pre-processing telemetry data, using supervised classification, anomaly detection, assessing the risk severity, applying policies to contain the threat and creating an audit-able report of the incident. The framework has not been implemented or validated. The framework will be validated using up-to-date data sets, precision, recall, false positive rate, detection latency, throughput and response time. High impact actions will be required to be approved by humans. The framework will focus on using AI as part of a wider system to assist with decision making.

Keywords

How to Cite This Article

Rights