Файл: Doi 10. 15514ispras201931(5)15.docx

Using ML for protection

The scope of ML usage in cybersecurity is huge, starting with identifying anomalies andsuspiciousorunusualbehavioursandendingwithdetectingzero-dayvulnerabilitiesandpatchingknown ones. Dilek et al. [12] presented the most comprehensive review of applications of MLtechniques.Reathi and Malathi [13] presented a set of ML algorithms trained on the NSL-KDD intrusiondetection dataset for misuse detection. Meanwhile, Buczak et al. [14] focused on networkintrusiondetectionusingML.Melicheretal.[15]proposedusingNNstocheckpasswordguessingresistance.Theycompressed the model to hundreds of kilobytes and developed a client-side JavaScript tool. Thesimilarexperiment wasconductedbyCiaramellaetal.[16].Toproactivelycheckthestrengthofpasswords, they use NNs, such as Multilayer Perceptron (MLP) and Single Layer Perceptrons(SLPs). Notably, MLPs provide better results than SLPs when testing datasets. Moreover, thenumberoflayersequalto10, andthusobtains betterresult.User and entity behaviour analytics (UEBA) use ML capabilities to analyze behaviour logs andnetworktrafficinreal-timeandrespondappropriatelyintheeventofanattack[17].Thisprocessisdonebygettingtheusertologinagain,blockinganattackorassessingrisklevelsandalertingthecompany’sinformationsecurityofficers sothattheycantakenecessaryaction.Most of the ML and DL methods, such as ensemble learning, clustering, and decision tree, [18]areusedtodetectmisuse, anomalyandhybridcyberintrusion.As mentioned in the Eugene Kaspersky Official Blog [19], Kaspersky detects 99% of cyberthreats using ML technology. The time interval between the disclosure of suspicious behaviouron the protected device and the release of the corresponding new 'tablet' lasts an average of 10minutes.DARPA collaborated with BAE Systems to develop a system that allow us to configure sensorsand apply protective measures 'at machine speed'. This initiative called the CHASE program,which stands for Cyber Hunting at Scale, seeks to develop automated tools to detect andcharacterize novel attack vectors, collect the right contextual data, and disseminate protectivemeasures bothwithinandacross enterprises[20].Cyberattacks performed by hacktivists relate to a common opinion about high-profile news.Information gathered from social media can help predict such incidents using NLP and MLtechniques [21].Moreover, we can use ML to identify the author of the program. Rachel Greenstadt and AylinCaliskan

---

developedasystemthatcan'deanonymize'programmers[22]byanalyzingsourcecodeorcompiledbinaryfiles[23].Identifyingthedeveloperofmalwareisnowmucheasier.Another way to monitor systems and networks for malicious activity or policy violation isthrough the intrusion detection system (IDS). Intrusion prevention system (IPS) is a systemconnected with IDS; these systems perform intrusion detection and stop the detected incidents.Both systems use supervised and unsupervised ML techniques to detecting point anomaly,contextualanomaly,andcollectiveanomaly[24].Themaintaskoffirewalls[25]istoensureanetworksecuritysystemthatmonitorsandcontrolsincoming and outgoing network traffic.Firewalls alloworblocktraffic by comparing itscharacteristics with predefined patterns (i.e. firewall rules). In their paper, Ucar and Ozhan [26]presented the result of the automatic detection of anomalies in firewall rule repository based onML and high-performance computing methods, such as Naive Bayes, kNN, Decision Table andHyperPipes. All six firewall rules from the given 93 rules were detected by the system andverified by the experts as an anomaly. Firewalls filter the content between servers, and there isalso a solution specifically meant for the content of web applications. Web application firewall(WAF) is deployed in front of web applications; it analyzes bi-directional web-based (HTTP)traffic and detects and blocks anything malicious [27]. WAF prevents vulnerabilities in webapplications from being exploited by outside threats. To implement such functionality in WAF,developers use regular expressions, tokens, behavioural analysis, reputation analysis and MLtechnologies[27].Among ML methods, special predictive ones can also be used for data loss/leak prevention(DLP) to reduce the risk for breaches or leaks [28]. DLP software solutions allows us to setbusinessrulesthatclassifyconfidentialandsensitiveinformationsothattheycannotbedisclosedmaliciously or accidentally by unauthorized end users. This process can be done by usingsupervised learning algorithms and two types of examples: positive examples (i.e. content thatneeds to be protected) and counterexamples (i.e. documents that are similar to the positive setbutshouldnotbeprotected).

4. 1   2   3   4   5   6   7

---

Using ML in cyberattacks

ThissectiondescribeshowcyberattackcansucceedusingML.Automatedvulnerabilityscanning is one of the most obvious and common tasks in a cyberattack. For example, CSRF isfound in only 5% of applications, as reported in the 2017 OWASP Top 10, because mostframeworks include CSRF defences [29]. Accordingly, Calzavara et al. presented Mitch [30],the first ML-based tool for the black-box detection of CSRF, which allows the identification of35 new CSRF vulnerabilities on 20 websites from the Alexa Top 10,000 websites and threepreviously undetected CSRF vulnerabilities on production software already analyzed with thestate-of-the-art tool Deemon [31]. Mitch is a binary classifier, labelling sensitive or insensitiverequests using a random forest algorithm on a 49-dimensional feature space. Compared to theheuristic classifiers BEAP [32] and CsFire [33], Mitch shows the best F1-score and precision(Table1).Marketers use ML methods for profiling. Trustwave released an open source intelligence toolthat uses face recognition to automatically track subjects across social media networks [34].Facialrecognitionaidsthisprocessbyremovingfalsepositivesinthesearchresults,makingdatareview fasterforahumanoperator.Table1.Validitymeasuresforthetestedclassifiers(BEAP,CsFire,Mitch)

Classifier	Precision	Recall	F1
BEAP	0.30	0.89	0.45

CsFire	0.20	0.97	0.33
Mitch	0.78	0.67	0.72

Using collected data about the target, an attacker can hook a victim with specially created fakenews. ML tools can help identify fake news, but to do so, researchers confirm that the best wayis for that ML to learn to create fake news itself [35]. As such, they created a model forcontrollable text generation called Grover. In the research process, four classes of articles wereused: human news, machine news, human propaganda and machine propaganda. Workers onAmazon Mechanical Turk rated each article, including overall trustworthiness. In the case ofpropaganda, the score increased from 2.19 (out of 3) on articles created manually to 2.42 onarticles createdbyamachine.SNAP_R was introduced at DEFCON 24. SNAP_R is the world's first automated end-to-endspear-phishingcampaigngeneratorforTwitter[36].Whileprevioustoolswerebasedonmodelswith Markov chains, SNAP_R is based on a recurrent NN with LSTM architecture. Using

---

Twitteras anenvironmentofferssomeadvantagesforautomatically generatingtext.Forexample,limitingthelengthofapostdecreasestheprobabilityofgrammaticalerrors.Moreover,Twitter links are often shortened, which allows masking of malicious domains. This, in turn,significantlyincreasedthesuccessratefrom5–14%onMarkovchain-basedtools[37,38]to30–66%, whichiscomparabletothe45%rateformanualspear-phishing[39].
Inmost cases, attackersdonot knowthemalwaredetectionalgorithmbutcanfigureoutfeaturesitusesthroughcarefullydesignedtest casesintheblack-boxalgorithm. MalGANisagenerativeadversarial network-based algorithm that generates adversarial malware examples that are abletobypassblack-boxML-baseddetectionmodels.Itcandecreasethedetectionratetonearlyzeroandmakeithardfortheretraining-baseddefensivemethodagainstadversarialexamplestowork[40].ThearchitectureofMalGAN isshowninfig. 3[40].Figure3.ArchitectureofMalGANThegeneratortakesthemalwarefeaturevectorandthenoisevectortotransformtheformerintoits adversarial version. Substitute detector is used to fit the black-box detector and providegradientinformationtotrainthegenerator.Bothnetsarerepresentedasmulti-layerfeed-forwardANNs. Adversarial examples tested against the black-box detector according to different MLmethodstrainedon160-dimensionalbinaryfeaturevectorsrepresentingsystemAPIcallsincluderandom forest, logistic regression, decision trees, support vector machines, and multi-layerperceptron as well as a voting-based ensemble of these algorithms. All these classifiers detectover 90% of original samples, but random forest and decision trees show the best result of less

---

than0.20%onadversarialexamples.Anti-malwarevendorsretraindetectorsafterexploringsuchundetectedexamples,butMalGANonlyneeds oneepochretrainingtoobtaina0%truepositiverate.Kawaietal. laterproposedsomeperformanceimprovements [41].
Fig.4.GeneratorarchitectureofPassGANFig.5.DiscriminatorarchitectureofPassGAN
Another example use case for GAN in cybersecurity is the password guessing attack. There is anew way of generating password guesses based on DL and generative adversarial networksknown as PassGAN [42]. The key difference in this approach is that NNs do not need a prioriknowledge of the structure of passwords, in contrast to approaches based on rules, Markovmodels[43]andFLA[15].PassGANusestheimprovedtrainingofWassersteinGANs(IWGAN) of Gulrajani et al. [44] with the ADAM optimizer [45]. The generator and thediscriminatorinPassGANarebuiltfromResNets[46].Thearchitectureofthegeneratorandthediscriminator are shown in fig. 4 and fig. 5 [42], while residual block representation is shown infig.6[42].Fig.6.ArchitectureofresidualblockinPassGANFor maximum effectiveness, attackers most likely use several password-cracking tools, such asa HashCat [47], John the Ripper [48], PCFGs [49], OMEN [50] and FLA [15] to combinedifferent attack methods. For example, by combining the output of PassGAN with the output ofHashCat Best64 [51], researchers were able to guess between 51% and 73% additional uniquepasswords comparedtoHashCat[47]alone.Traditional botnets wait for commands from the C&C, but now, attackers use automation tomake decisions independently. Fortinet researchers predicted that cybercriminals will replacebotnets with intelligent clusters of compromised devices called hivenets, a type of attack that isable to leverage peer-based self-learning to target vulnerable systems with minimal supervision[52].In the initial stages of an attack, attackers oftenface the challenge of bypassing captcha.Suphannee et al. [53] designed a low-cost attack that uses DL technologies for the semanticannotations of images. The system requires about 19 seconds per challenge to solve challenges,with anaccuracyof70.78%for reCaptcha[54]and83.5%fortheFacebookimagecaptcha.Thesystem has to automatically identify which of the given images are semantically similar to the

---