You're reading from Artificial Intelligence for Cybersecurity Develop AI approaches to solve cybersecurity problems in your organization

Product type Paperback

Published in Oct 2024

Publisher Packt

ISBN-13 9781805124962

Length 358 pages

Edition 1st Edition

Concepts

Data Governance

Authors (4):

Bojan Kolosnjaji

Apostolis Zarras

Huang Xiao

Peng Xu

Preface

1. Part 1: Data-Driven Cybersecurity and AI FREE CHAPTER

2. Chapter 1: Big Data in Cybersecurity

3. Chapter 2: Automation in Cybersecurity

4. Chapter 3: Cybersecurity Data Analytics

5. Part 2: AI and Where It Fits In

6. Chapter 4: AI, Machine Learning, and Statistics - A Taxonomy

7. Chapter 5: AI Problems and Methods

8. Chapter 6: Workflow, Tools, and Libraries in AI Projects

9. Part 3: Applications of AI in Cybersecurity

10. Chapter 7: Malware and Network Intrusion Detection and Analysis

11. Chapter 8: User and Entity Behavior Analysis

12. Chapter 9: Fraud, Spam, and Phishing Detection

13. Chapter 10: User Authentication and Access Control

14. Chapter 11: Threat Intelligence

15. Chapter 12: Anomaly Detection in Industrial Control Systems

16. Chapter 13: Large Language Models and Cybersecurity

17. Part 4: Common Problems When Applying AI in Cybersecurity

18. Chapter 14: Data Quality and its Usage in the AI and LLM Era

19. Chapter 15: Correlation, Causation, Bias, and Variance

20. Chapter 16: Evaluation, Monitoring, and Feedback Loop

21. Chapter 17: Learning in a Changing and Adversarial Environment

22. Chapter 18: Privacy, Accountability, Explainability, and Trust – Responsible AI

23. Part 5: Final Remarks and Takeaways

24. Chapter 19: Summary

25. Index

26. Other Books You May Enjoy

Shortcomings of traditional tools

Traditional signature-based defenses are becoming insufficient for the following reasons:

Evolution of attacker techniques: Security rules are static by nature, and as the software evolves, new vulnerabilities are found and new attacker techniques arise that can be used to circumvent the defenses. This requires the security operations teams to constantly change the security rules to keep their false positive and false negative rate at a minimum, often with limited resources.
Insider threats: Static rules can often be circumvented by insiders who have knowledge and are part of the organization of the systems (for example, disgruntled employees) or attackers with stolen credentials. They can adjust their behavior to look similar to the behavior of a valid user and stay under the radar while performing their attacker activities.
Context is needed: Many times, attacker behavior can look like normal behavior without having a full context...