Cybersecurity for Artificial Intelligence

Description

This book explores new and novel applications of machine learning, deep learning and artificial intelligence that are related to major obstacles in the field of cybersecurity. The provided research goes beyond applying AI techniques to datasets that have derived from problems in cybersecurity which the authors illustrate in this book. This book also provides insight into the difficult "how" and "why" questions that arise in AI within the security domain. For example, this book includes chapters covering "explainable AI", "adversarial learning", "resilient AI", and a wide variety of related topics. It’s not limited to any specific cybersecurity subtopics and the chapters touch upon a wide range of cybersecurity domains, ranging from malware to biometrics and more. Researchers and advanced level students working and studying in the fields of cybersecurity (equivalently, information security) or artificial intelligence (including deep learning, machine learning, big data, and related fields) will want to purchase this book as a reference. Practitioners working within these fields will also be interested in purchasing this book. Preface Contents About the Editors Part I Malware-Related Topics Generation of Adversarial Malware and Benign Examples Using Reinforcement Learning 1 Introduction 2 Background 2.1 Adversarial Machine Learning 2.1.1 Taxonomy 2.2 Reinforcement Learning 2.3 Portable Executable File Format 3 Implementation 3.1 Overview 3.2 Dataset 3.3 PE File Modifications 3.4 Target Classifier 3.5 Agent and Its Environment 4 Evaluation 4.1 Adversarial Malware Examples 4.2 Adversarial Benign Examples 5 Related Work 5.1 Gradient-Based Attacks 5.2 Reinforcement Learning-Based Attacks 5.3 Other Methods 6 Conclusion 6.1 Future Work References Auxiliary-Classifier GAN for Malware Analysis 1 Introduction 2 Related Work 3 Methodology 3.1 Data 3.2 AC-GAN 3.3 Evaluation Plan 3.3.1 CNN 3.3.2 ELM 3.4 Accuracy 4 Implementation 4.1 Dataset Analysis and Conversion 4.1.1 Datasets 4.2 AC-GAN Implementation 4.2.1 AC-GAN Generator 4.2.2 AC-GAN Discriminator 4.3 Evaluation Models 4.3.1 CNN Implementation 4.3.2 ELM Implementation 5 Experimental Results 5.1 AC-GAN Experiments 5.1.1 AC-GAN with 3232 Images 5.1.2 AC-GAN with 6464 Images 5.1.3 AC-GAN with 128128 Images 5.1.4 Summary of AC-GAN Results 5.2 CNN and ELM Experiments 5.2.1 CNN and ELM for 3232 Images 5.2.2 CNN and ELM for 6464 Images 5.2.3 CNN and ELM for 128128 Images 5.2.4 Discussion of CNN and ELM Experiments 6 Conclusion and Future Work References Assessing the Robustness of an Image-Based Malware Classifier with Smali Level Perturbations Techniques 1 Introduction 2 Background and Related Works 2.1 Static Malware Analysis 2.2 Convolutional Neural Network 2.2.1 Convolution 2.2.2 Subsampling 2.2.3 Classification 2.3 Dalvik VM and Dalvik EXecutable 2.4 Image-Based Malware Classification 3 Methodology 3.1 Untargeted Misclassification 4 Implementation and Experiments 5 Conclusion and Future Work References Detecting Botnets Through Deep Learning and Network Flow Analysis 1 Introduction 2 Background 2.1 Introduction to Botnets 2.2 Autocorrelation Analysis 2.3 Deep Neural Networks 3 Related Work 4 Dataset 4.1 CTU-13 Dataset Features 5 Proposed Methodology 5.1 Data Preprocessing Phase 5.1.1 Filtering Network Flow 5.1.2 Constructing Network Graph 5.1.3 Statistical Analysis of Edges 5.1.4 Autocorrelation Analysis 5.2 Deep Learning Phase 5.2.1 Stratified Lg-Fold Cross Validation 5.2.2 Define, Compile, and Fit the Neural Network 5.2.3 Model Evaluation 6 Results 7 Conclusions References Interpretability of Machine Learning-Based Results of Malware Detection Using a Set of Rules 1 Introduction 2 Related Works 3 Rule-Based Classification 3.1 From Trees to Rules 3.2 Rule-Learning Algorithms 4 Implementation of Rule-Based Classifiers 4.1 Decision List 4.2 I-REP 4.3 RIPPER 5 Experiments 5.1 Dataset Description 5.2 Data Splitting 5.3 Feature Transformation and Selection 5.4 Evaluation Metrics 5.5 Interpretability of Machine Learning Models 5.6 Measuring Performance of RBCs on ML Predictions 5.7 Interpreting ML Results Using RBCs 5.8 Pruning and Metrics 5.9 Does Order of the Rules Matter? 6 Conclusion and Future Work References Mobile Malware Detection Using Consortium Blockchain 1 Introduction 2 Use Case 3 Android Application Components 3.1 Activities 3.2 Services 3.3 Broadcast Receivers 3.4 Content Providers 4 Role in Malware Detection 5 The Blockchain Network 6 Related Works 7 Methodology 7.1 APK Files 7.2 Trusted Server 7.3 Adding a Record 7.4 Members of the Consortium 7.5 Blockchain Ledger 7.6 Final Response 7.7 Technology Behind Blockchain Network 8 Implementation Details 8.1 Scenario 1 8.2 Scenario 2 8.3 Initializing Block for Unknown apk 8.4 Updating Block with Vote and Features 8.5 Setting the State of the apk After Counting All the Votes 9 Feature Extraction and Model Training 10 Dataset and Experimentation 11 Results 12 Conclusion References BERT for Malware Classification 1 Introduction 2 Related Work 3 Background 3.1 NLP Models 3.1.1 Word Embeddings 3.1.2 Word2Vec 3.1.3 BERT 3.2 Classifiers 3.2.1 Logistic Regression 3.2.2 SVM 3.2.3 Random Forests 3.2.4 MLP 4 Experiments and Results 4.1 Dataset 4.2 Methodology 4.3 Classifier Parameters 4.4 Logistic Regression Results 4.5 SVM Results 4.6 Random Forest Results 4.7 MLP Results 4.8 Further Analysis 4.9 Summary 5 Conclusions and Future Work References Machine Learning for Malware Evolution Detection 1 Introduction 2 Background 2.1 Malware 2.2 Related Work 2.3 Dataset 2.4 Learning Techniques 2.4.1 Hidden Markov Models 2.4.2 Word2Vec 2.4.3 HMM2Vec 2.4.4 Logistic Regression 3 Experiments and Results 3.1 Logistic Regression Experiments 3.2 Hidden Markov Model Experiments 3.3 HMM2Vec Experiments 3.4 Word2Vec Experiments 3.5 Discussion 4 Conclusion and Future Work Appendix References Part II Other Security Topics Gambling for Success: The Lottery Ticket Hypothesis in Deep Learning-Based Side-Channel Analysis 1 Introduction 2 Background 2.1 Notation 2.2 Supervised Machine Learning in Profiling SCA 2.3 Leakage Models and Datasets 3 Related Works 4 The Lottery Ticket Hypothesis (LTH) 4.1 Pruning Strategy 4.2 Winning Tickets in Profiling SCA 5 Experimental Results 5.1 Baseline Neural Networks 5.2 ASCAD with a Fixed Key 5.3 ASCAD with Random Keys 5.4 CHES CTF 2018 5.5 General Observations 6 Conclusions and Future Work References Evaluating Deep Learning Models and Adversarial Attacks on Accelerometer-Based Gesture Authentication 1 Introduction 2 Related Work 3 Background 3.1 Support Vector Machines 3.2 1D Convolutional Neural Networks 3.3 Adversarial Strategy 3.3.1 Deep Convolutional Generative Adversarial Networks 4 Dataset 4.1 Data Collection 4.2 Data Preprocesssing 4.2.1 Feature Engineering 4.2.2 Time Series Resampling 5 Implementation 5.1 DC-GAN Structure 5.2 Adversarial Attack 6 Experiments and Results 6.1 SVM Results 6.2 1D-CNN Results 6.3 Adversarial Results 7 Conclusion and Future Work References Clickbait Detection for YouTube Videos 1 Introduction 2 Background 2.1 Related Work 2.1.1 Clickbait Detection 2.1.2 Fake News Detection 2.1.3 Forgery Detection 2.1.4 Hoax Detection 2.2 Natural Language Processing 2.3 Learning Techniques 2.3.1 Logistic Regression 2.3.2 Random Forest 2.3.3 Multilayer Perceptron 3 Implementation 3.1 Hardware and Software 3.2 Approach 3.3 Features 3.4 Dataset 3.5 Experiments 3.5.1 Experiment I: Logistic Regression with Word2Vec 3.5.2 Experiment II: Random Forest with Word2Vec 3.5.3 Experiment III: MLP with Word2Vec 3.5.4 Experiment IV: MLP with DropOut, Batch Normalization, and Word2Vec 3.5.5 Experiment V: MLP with BERT 3.5.6 Experiment VI: MLP with DistilBERT 4 Results 5 Conclusion and Future Works Appendix: Model Architectures References Survivability Using Artificial Intelligence Assisted Cyber RiskWarning 1 Introduction 2 Related Work 3 Security Infringement Detection 3.1 Static Analysis of Code 3.2 Methodology 3.3 Results 3.4 Evaluation 4 Digital Twin Cyber Resilience Decision Support 4.1 Landscape Model Development 5 Semi-Markov Cloud Availability Model 6 Future Work 7 Conclusions References Machine Learning and Deep Learning for Fixed-Text Keystroke Dynamics 1 Introduction 2 Background 2.1 Keystroke Dynamics 2.2 Learning Techniques 2.2.1 Random Forest 2.2.2 Support Vector Machine 2.2.3 K-Nearest Neighbors 2.2.4 T-SNE 2.2.5 XGBoost 2.2.6 LSTM and Bi-LSTM 2.2.7 Convolutional Neural Network 2.2.8 Multi-Layer Perceptron 3 Previous Work 4 Dataset 5 Experiments and Results 5.1 Data Exploration 5.2 Classification Results 5.2.1 K-Nearest Neighbor Experiments 5.2.2 Random Forest Experiments 5.2.3 Support Vector Machine Experiments 5.2.4 XBGoost Experiments 5.2.5 Multilayer Perceptron Experiments 5.2.6 Convolutional Neural Network Experiments 5.2.7 Recurrent Neural Network Experiments 5.2.8 LSTM Experiments 5.3 Summary and Discussion 6 Conclusion and Future Work References Machine Learning-Based Analysis of Free-Text Keystroke Dynamics 1 Introduction 2 Background 2.1 Keystroke Dynamics 2.2 Previous Work 2.2.1 Distance Based Research 2.2.2 Machine Learning Based Research 3 Implementation 3.1 Dataset 3.2 Techniques Considered 3.2.1 BERT 3.2.2 CNN-GRU Model 4 Free-Text Experiments 4.1 Text-Based Classification 4.2 Keystroke Dynamics Models 4.2.1 Features 4.2.2 Parameter Tuning 4.2.3 Fine Tuning 4.2.4 GRU with Word Embedding 4.2.5 CNN-Transformer 4.2.6 CNN-GRU-Cross-Entropy-Loss 4.2.7 Rotation Subset 4.2.8 Robustness 4.2.9 Explainability 4.2.10 Equal Error Rate 4.2.11 Knowledge Distilling 4.2.12 Weighted Loss 4.2.13 Ensemble Models 4.2.14 Discussion 5 Conclusion and Future Work References Free-Text Keystroke Dynamics for User Authentication 1 Introduction 2 Background 2.1 Related Work 2.2 Datasets 2.2.1 Buffalo Keystroke Dataset 2.2.2 Clarkson II Keystroke Dataset 2.3 Deep Leaning Algorithms 2.3.1 Multilayer Perceptron 2.3.2 Convolutional Neural Network 2.3.3 Recurrent Neural Network 2.3.4 Cutout 3 Feature Engineering 3.1 Features 3.2 Length of Keystroke Sequence 3.3 Keystroke Dynamics Image 3.4 Keystroke Dynamics Sequence 3.5 Cutout Regularization 4 Architecture 4.1 Multiclass vs Binary Classification 4.2 Hyperparameter Tuning 4.3 Implementations 4.3.1 CNN 4.3.2 CNN-RNN 5 Experiment and Result 5.1 Metrics 5.2 Result of Free-Text Experiments 5.2.1 Length of Keystroke Subsequence 5.2.2 CNN Kernel Sizes 5.2.3 Embedding Method 5.2.4 RNN Structure 5.2.5 Cutout Experiments 5.3 Discussion 6 Conclusion Appendix References