Cyber Defense eMagazine August 2019

are not using machine learning in one way or another. The only limit once the technology is developed is
how far each industry is willing to take it. Currently, artificial intelligence is not being used to its full
capabilities.
How Is It Currently Helping Cyber Defense?
It makes sense that machine learning should be used to help in some way for preventing cyber-attacks
and malicious behaviour given its advanced capabilities. It can learn what it deems to be “normal” online
behaviour and then distinguish suspicious behaviour using a custom algorithm. This could be a game
changer for hackers, who will find it harder than ever to get into a system once it’s protected by machine
learning security.
Here are some of the most important problems facing websites and ways in which machine learning is
impacting cyber defense to prevent them:
Watering Hole
This term refers to when hackers try to attack a site that has a high number of traffic. The hackers then
try to gain users’ data, drawing it from whoever has visited. Machine learning can prevent this by creating
algorithms for the site. It ensures the security standard by analysing the path of visitors coming to the
website. Machine learning works by predicting outcomes and learning from them, whether they were
correct or not. By applying this logic, it can detect whether users are directed to malicious websites by
following previous visitor paths. It can then alert the user that the site may be harmful, giving them the
option to go back.
Ransomware
Ransomware defines the combination of ransom and software. This is when a hacker gets hold of private
information or data and demands a sum in exchange for the encryption key to the stolen files. AI can use
deep learning algorithms to detect unknown ransomware and analyse the behaviours of ransomware
attacks. This can then be used to check the files so security actions can be taken before it infiltrates the
whole file system and locks access to the computer.
Webshell
Webshell is a piece of code inputted onto a website by a hacker which allows them to make changes on
the web root directory of the server. Hackers can even access customers personal credit card information
if it’s an e-commerce site. They can also modify the transactions, so the payments go through a different
path, exploiting the system so they receive the payment. Machine learning can help by indemnifying
normal behaviour from potentially harmful behaviour. Files capable of harmful activity can be isolated
before they have the chance to exploit the system.
69