When it comes to antivirus software, some vendors are hailing machine learning as the silver bullet to malware — but how much truth is there to these claims?

In today’s post, we’re going to take a look at how machine learning is used in antivirus software and whether it really is the perfect security solution.

How does machine learning work?

In the antivirus industry, machine learning is typically used to improve a product’s detection capabilities. Whereas conventional detection technology relies on coding rules for detecting malicious patterns, machine learning algorithms build a mathematical model based on sample data to predict whether a file is “good” or “bad”.

In simple terms, this involves using an algorithm to analyze the observable data points of two, manually created data sets: one that includes only malicious files, and one that includes only non-malicious files.

The algorithm then develops rules that allow it to distinguish the good files from the bad, without being given any direction about what kinds of patterns or data points to look for. A data point is any unit of information related to a file, including the internal structure of a file, the compiler that was used, text resources compiled into the file and much more.

The algorithm continues to calculate and optimize its model until it ends up with a precise detection system that (ideally) doesn’t classify any good programs as bad and any bad programs as good. It develops its model by changing the weight or importance of each data point. With each iteration, the model gets slightly better at accurately detecting malicious and non-malicious files.

Machine learning can help detect new malware

Machine learning helps antivirus software detect new threats without relying on signatures. In the past, antivirus software relied largely on fingerprinting, which works by cross-referencing files against a huge database of known malware.

The major flaw here is that signature checkers can only detect malware that has been seen before. That’s a rather large blind spot, given that hundreds of thousands of new malware variants are created every single day.

Machine learning, on the other hand, can be trained to recognize the signs of good and bad files, enabling it to identify malicious patterns and detect malware – regardless of whether it’s been seen before or not.

The limitations of machine learning

While machine learning can be a very effective tool, the technology does have its limitations.

Potential for exploitation

One of the key weaknesses of machine learning is that it doesn’t understand the implications of the model it creates – it just does it. It simply uses the most efficient, mathematically-proven method to process data and make decisions.

As noted earlier, the algorithm is fed with millions of data points but without anyone specifically telling it which data points are indicators for malware. That’s up for the machine learning model to discover on its own.

The upshot of this is that no human can ever really know which data points might – according to the machine learning model – indicate a threat. It could be a single data point, or a specific combination of 20 data points. A motivated attacker could potentially discover how the model uses these parameters to identify a threat and use it to their advantage. Changing one specific, seemingly non-relevant data point in a malicious file could be enough to trick the model into classifying malware as safe and undermine the whole model.

To rectify the issue, the vendor would have to add the manipulated file to the data set and recalculate the entire model, which could take days or weeks. Unfortunately, this still wouldn’t fix the underlying problem – even after the model was rebuilt, it would just be a matter of time until the attacker found another data point or combination of data points that could be used to fool the machine learning system.

That’s exactly what happened in July 2019, when researchers at Skylight Cyber discovered that a popular AI-based security product had whitelisted certain files to avoid triggering false positives. The strings of code in these whitelisted files were given a lot of weight in the algorithm’s scoring system, which meant they were almost guaranteed to override the algorithm’s natural decision-making process. When the model encountered the code contained in the whitelisted files, it flagged the file as safe – even if it was embedded in an otherwise malicious file. As a result, the researchers were able to undermine the algorithm by simply taking strings of code from a non-malicious whitelisted gaming file and attaching them to a malicious file.

As the researchers noted, this type of attack would not have been possible if the product used additional protection technologies such as a signature scanner, which doesn’t rely on algorithms, or heuristics, which detects threats based on behavior rather than a file’s parameters.

Requires a large, well-labeled dataset

Machine learning systems are only as good as the data they are supplied with. Training an effective model requires an enormous number of data inputs, each of which needs to be correctly labeled. These labels help the model understand certain characteristics about the data (e.g. whether a file is clean, malicious or potentially unwanted).

However, the model’s ability to learn effectively depends on the dataset being perfectly labeled, which can be difficult and resource-intensive to achieve. A single mislabeled input among millions of perfectly labeled data points may not sound like a big deal, but if the model uses the mislabeled input to form a decision, it can result in errors that are then used as the basis for future learning. This creates a snowball effect that can have significant repercussions further down the line.

A layered approach to cybersecurity

Machine learning is a powerful technology that may play an increasingly important role in the cybersecurity world in the years ahead. However, as mentioned above, it does have its flaws and limitations. Relying on antivirus software that is powered exclusively by AI or machine learning may leave you vulnerable to malware and other threats.

Solutions that use a combination of protection technologies will likely provide better security than a product that is entirely AI-based. For example, Emsisoft leverages the power of AI and machine learning as well as other protection technologies such as behavioral analysis and signature checkers. These systems work in synergy to double and triple-check each other’s results in order to provide you with the best malware protection possible.

Taking a multi-layered approach to security allows you to avoid putting all your eggs in one basket and maximizes your chances of stopping malware before it can infect your system.

The post The pros, cons and limitations of AI and machine learning in antivirus software appeared first on Artificial Intelligence.

Artificial intelligence (AI) is accepting the situation as a warrior against digital threats over the globe. It has gotten mainstream in military space, yet security organizations are likewise consolidating AI technologies for using deep learning to discover likenesses and differences within a data set. Organizations like Microsoft are putting 1 billion USD in AI-based organizations, for example, Open AI. In an always advancing cyber threat landscape where antivirus programming and firewalls are viewed as tools of antiquity, companies are currently searching for all the more technologically advanced methods for protecting classified and sensitive data.

As indicated by ESG research, 29% of security experts would like to utilize AI innovation to accelerate the virus detection process. Furthermore, 27% are looking to this innovation to accelerate their incident response time. Interest for AI security stems from the complexity of code AI can analyze in a short amount of time.

Despite the fact that AI can be useful in the cybersecurity space, for the most part, it’s not AI that is driving these solutions. As a rule, trained machine learning and AI are terms that get confounded. Where AI and machine learning differ in their capacity to think without legitimate programming. Security organizations utilize machine learning to write complex algorithms for these technologies to best identify security breaches. However, an AI system can reach new resolutions without being nourished any new algorithms or data.

A challenge for machine learning in the security space is that malware codes are constantly changing, which implies the coders behind machine learning cybersecurity innovation should always be perfect and change algorithms to show the innovation how to detect these new codes. However, can the defenders truly stay aware of hackers? That is certainly begging to be proven wrong. This is an issue AI could understand. If a conscious machine can develop at the rate of its malware partners, we have a much better shot of defending against it.

Disappointment by governments to take proactive measures to ensure the security of AI frameworks “is going to come back to bite us,” Omar Al Olama, minister of state for artificial intelligence for the United Arab Emirates, warned. Studies recommend one of the most noteworthy issues which lie in the destabilizing impacts of cyber weaponry, increased by AI technologies on the regional balance of power.

Artificial intelligence has the ability to get converged with new, complex yet untried weaponry, for example, cyber offensive capabilities. This improvement is alarming as cyber offensive weapons have the ability to destabilize the equalization of military power among the leading countries. With the advent of AI and machine learning, cyberattacks have become all the more commonly available dangers for critical infrastructure like airport flight tracking, banking systems, hospital records, and programs that run the country’s basic infrastructure and nuclear reactors.

In spite of the fact that there is no definite proof that critical infrastructure command and control systems are inclined to cyberattacks yet because of the digitization of these systems, thus the vulnerability exists. The destabilizing impact of AI cyber weaponry stays a huge matter of concern for each country. Undoubtedly, protecting against these weapons, and shielding the country’s software, hardware and private information against cyberattacks have become a vital issue for national security.

Policymakers should intently work with technical experts to investigate, prevent and counter potential threatening uses of AI. Studies recommend that AI zero-day vulnerabilities are being made which are not openly known at this point, so it gets hard to build up its fix until its first experiment. Moreover, conducting red team exercises in the AI domain area like DARPA Cyber Grand Challenge will likewise assist better with understanding the level to do attacks and find the barriers. Present research in the public domain is restricted to white hat hackers just which is planned for utilizing machine learning to discover vulnerabilities and recommend fixes.

As not out of the ordinary, the utilization of machine learning to advance cyber threats is developing alongside the utilization of these advancements for security and protection, explicitly while producing new malware samples. It’s anticipated that programmers will utilize these technologies to modify code in new samples dependent on how security systems identified more older diseases. This will build the lifespan of an infection in a system since it will be smaller and increasingly hard to detect.

The speed AI is developing, won’t take a lot of time that attackers would utilize AI abilities on a mass scale. Artificial intelligence could demonstrate a cybersecurity threat in an unobtrusive manner. As AI-driven and machine learning products are set to be utilized as a major aspect of defense technique, there are chances that it could calm IT experts and employees into a false sense of security. Today AI solutions are in the experimenting stage, and complete dependence on them could be a botch.

The post The Crucial role of Cyber security and Artificial Intelligence (AI) appeared first on Artificial Intelligence.