AI for Cybersecurity: Robust models for Authentication, Threat and Anomaly Detection

Cybersecurity  models include provisions for legitimate user and agent authentication,  as well as algorithms for detecting external threats, such as intruders  and malicious software. In particular, we can define a continuum of  cybersecurity measures ranging from user identification to risk-based  and multilevel authentication, complex application and network  monitoring, and anomaly detection. We refer to this as the "anomaly  detection continuum". Machine learning and other artificial intelligence  technologies can provide powerful tools for addressing such issues, but  the robustness of the obtained models is often ignored or  underestimated. On the one hand, AI-based algorithms can be replicated  by malicious opponents, and attacks can be devised so that they will not  be detected (evasion attacks). On the other hand, data and system  contexts can be modified by attackers to influence the countermeasures  obtained from machine learning and render them ineffective (active data  poisoning). This Special Issue presents ten papers that can be grouped  under five main topics: (1) Cyber-Physical Systems (CPSs), (2) Intrusion  Detection, (3) Malware Analysis, (4) Access Control, and (5) Threat  intelligence.

AI is increasingly being used in  cybersecurity, with three main directions of current research: (1) new  areas of cybersecurity are being addressed, such as CPS security and  threat intelligence; (2) more stable and consistent results are being  presented, sometimes with surprising accuracy and effectiveness; and (3)  the presence of an AI-aware adversary is recognized and analyzed,  producing more robust solutions.