Artificial Intelligence for Cybersecurity

Andrea Saracino, IIT-CNR

Roma - 29 Ottobre 2018

Application of Artificial Intelligence

Artificial Intelligence and Machine Learning

Machine Learning

Unsupervised Learning

Clustering

Clustering (2)

• Can be aggregative or divisive

• Able to work on unlabeled data

• Automatically infers patterns out of input data

• Fast thanks to low complexity

• Does not characterize results

Supervised Learning

Supervised Learning - Training

Machine Learning

Algorithm

ExpectedOutput

Supervised Learning - Application

ModelInput Output

Classification

• Assigning a label (class) to each sample of a dataset.

Machine Learning

Algorithm

Feature Extraction

Feature Apple Orange

Shape Not Round Round

Skin Smooth Non-Smooth

Color Not Orange Orange

A1: 0,1,0O1: 1,0,1

Evaluation Indexes

True Acceptance (Match) Rate (TAR) - Probability to correctly match input pattern to a

matching template. It measures the percent of valid inputs which are correctly accepted.

True Rejection (Non Match) Rate (TRR) - Probability to correctly detect non-matching input

pattern to any template stored in the database. It measures the percent of invalid inputs which

are correctly rejected.

False Acceptance Rate (FAR) - Probability to incorrectly match input pattern to a non-matching

template stored in the database. It measures the percent of invalid inputs which are incorrectly

accepted. It is more dangerous than FRR.

False Rejection Rate (FRR) - Probability to fail to detect a match between the input pattern and

a matching template in the database. It measures the percent of valid inputs which are

incorrectly rejected.

Deep Learning-based Methodologies

• Techniques very effective for image recognition problems• Classify objects

• Detecting presence

• Identifying similarities

• Applied widely to face detection starting from 2014

Difference With Machine Learning

Deep learning: architecture structure

Deep CNN architecture example

Applications to Cybersecurity

SPAM email analysis

• Unsolicited advertisement message sent to a large number of Internet users via email

SPAM analysis services

Anti-Spam Filter: HAM vs SPAM

• Based on Deep Learning and Bayesian Classifiers

SPAM analysis service

Threat Identification:

• Advertisement

• Phishing

• Confidential Trick

• Malware

• Portal

Phishing

Malware

Portal

Spam Campaign

Spammer

BotBot Bot

SPAM analysis service

• Campaign Clustering

Categorical Clustering Tree (CCTree)

• Entropy-based clustering algorithm and classifier

• Exploting structural features• Not based on semantic

• Fast and accurate

Malware Analysis

Network Traffic Analysis

Techniques

• Sketch analysis for DDoS prevention

• Text analysis for DGA Recognition

• Cybersquatting automated detection

Behavioral Authentication

Gait-Based Authentication

• Using the walking pattern of a person to verify her identity.

• Each person as a completely unique walking pattern• Mix of physical (biometric) elements and behavioral ones.

Gait Analysis

• Analyzing a person movement pattern.• Monitor clinical conditions related to walking pattern

• Fall detection for early assistance to elderly people

• Extraction of features for user identification

Gait Analysis (2)

• Can be performed by means of accelerometers

• Extraction of acceleration on the three axis

• Multiple accelerometers allow to monitor different parts of the body.

Workflow

• Usage of deep learning and accelerometers for user authentication.

Authenticated

Not Authenticated

Monitoring Extraction Filtering Classification

Framework

• Classifier based on Convolutional Neural Network (CNN).

• Features extracted from 5 body sensors

• Readings normalized and filtered for noise reduction

• Normalized readings are used to train and then test deep learningCNN.

Results

Concluding

• More and more application related to cybersecurity exploit AI

• Increasing need of knowledge to design and tune-up specific machine learning methodologies

• Beware of possible malicious use of machine learning

Thank You

andrea.saracino@iit.cnr.it

Artificial Intelligence for Cybersecurity · Artificial Intelligence and Machine Learning. Machine...

Documents

LEARNING OF GRASPS FOR AN ARTIFICIAL HAND BY …facta.junis.ni.ac.rs/macar/macar2007s/macar2007s04.pdf · Learning of Grasps for an Artificial Hand by Time Clustering and Takagi-Sugeno

Artificial Life Learning

Clustering - University of Adelaidedsuter/Harbin_course/clustering.pdf · Artificial Intelligence Clustering Instructors: David Suter and QinceLi Course Delivered @ Harbin Institute

CS 391L: Machine Learning Clustering

Machine learning clustering

Unsupervised Learning and Clustering

Gaussian Process Clustering - TU Berlin · 2015. 1. 13. · Project in Artificial Intelligence and Machine Learning Clustering Algorithm based on Gaussian Process 2 1. Introduction

Clustering Supervised vs. Unsupervised Learning Examples of clustering in Web IR Characteristics of clustering Clustering algorithms Cluster Labeling 1

Unsupervised Learning and Clustering - University of …rita/ml_course/lectures_old/Clustering.pdf · Unsupervised Learning and Clustering. ... Iterative Optimization Algorithms

Introduction to Artificial Intelligence Unsupervised Learning · Clustering Clustering is one of the most utilized data mining techniques It has a long history, and used in almost

Using Clustering as a Prewriting Strategy Introduction Learning to Write Learning Baseball Learning to Ski Learning to Kayak 1 Clustering and Papers.ppt

STAT 408 - Statistical Learning Clustering€¦ · Statistical Learning Clustering Unsupervised Learning k-means clustering ## K-means clustering with 3 clusters of sizes 44, 26,

Artificial Intelligence, Machine Learning, Deep Learning ... · Deep Learning Artificial Intelligence Machine Learning Artificial Intelligence Technique where computer can mimic human

Clustering in artificial intelligence

Unsupervised Learning: K-means Clusteringi-systems.github.io/HSE545/machine learning all/05 Clustering/01_K... · Unsupervised Learning Data clustering is an unsupervised learning

Unsupervised Learning: Clustering

Machine Learning : Clustering, Self-Organizing Mapsds24/lehre/ml_ws_2013/ml_09_clust.pdf · Clustering 12/12/2013 Machine Learning : Clustering, Self-Organizing Maps 2 The task: partition

Chapter 7: Competitive learning, clustering, and self ...arpaiva/classes/UF_eel6814/clustering_and_SOM.pdf · Clustering Clustering is a particular example of competitive learning,

A Hybrid Artificial Neural Network Model for Data Visualisation, Classification, And Clustering

Unsupervised Learning Clustering Algorithms - IT - websiteafred/tutorials/B_Clustering_Algorithms.pdf · 2 3 Unsupervised Learning Clustering Algorithms Unsupervised Learning -- Ana