AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection

• Other Authors: Bergadano, Francesco (Editor), Giacinto, Giorgio (Editor)
• Format: Electronic Book Chapter
• Language: English
• Published: Basel MDPI - Multidisciplinary Digital Publishing Institute 2023
• Subjects: Technology: general issues; History of engineering & technology; Mechanical engineering & materials; Internet of Things; cybersecurity; cyber threats; malware detection; machine learning; network traffic; cooperative intelligent transportation systems (cITSs); IDS; vehicular ad-hoc networks (VANET); adaptive model; deep belief network (DBN); NIDS; deep learning; false negative rate; artificial neural network; MITRE ATT&CK Matrix; techniques classification; BERT-based multi-labeling; formal ontology; risk identification; vulnerability; portable executable malware; tree-based ensemble; performance comparison; statistical significance test; adversarial examples; face recognition; mask matrix; targeted attack; non-targeted attack; anomaly detection; attack detection; cyber-physical system; datasets; evaluation metrics; biometric cryptosystem; iris identification; error-correcting codes; intrusion detection; smart grid; neural networks; n/a
• Online Access: DOAB: download the publication; DOAB: description of the publication

Cybersecurity models include provisions for legitimate user and agent authentication, as well as algorithms for detecting external threats, such as intruders and malicious software. In particular, we can define a continuum of cybersecurity measures ranging from user identification to risk-based and multilevel authentication, complex application and network monitoring, and anomaly detection. We refer to this as the "anomaly detection continuum". Machine learning and other artificial intelligence technologies can provide powerful tools for addressing such issues, but the robustness of the obtained models is often ignored or underestimated. On the one hand, AI-based algorithms can be replicated by malicious opponents, and attacks can be devised so that they will not be detected (evasion attacks). On the other hand, data and system contexts can be modified by attackers to influence the countermeasures obtained from machine learning and render them ineffective (active data poisoning). This Special Issue presents ten papers that can be grouped under five main topics: (1) Cyber-Physical Systems (CPSs), (2) Intrusion Detection, (3) Malware Analysis, (4) Access Control, and (5) Threat intelligence.AI is increasingly being used in cybersecurity, with three main directions of current research: (1) new areas of cybersecurity are being addressed, such as CPS security and threat intelligence; (2) more stable and consistent results are being presented, sometimes with surprising accuracy and effectiveness; and (3) the presence of an AI-aware adversary is recognized and analyzed, producing more robust solutions.