How to Leverage AI for Cyber Defense Strategies

Artificial intelligence, or "AI," frequently grabs attention in the evolving world of security. It's no surprise that discussions surrounding AI dominate the cybersecurity news cycle, often focusing on the negative issues it raises. There is a prevalent fear that lesser-skilled threat actors are using AI as a potent tool to launch cyberattacks. While this concern is understandable, the blue team - the defenders - can use the very same generative AI tools to empower their own defensive strategies and innovations. In this edition of 'The Sting of Security,' we will highlight six ways to leverage AI for defensive purposes.?

AI - A Cause for Concern?

We've seen the unsettling reality of generative AI in action. Tools like ChatGPT, initially created with good intentions, are being repurposed for malicious use by threat actors. The Security Lab at Hornetsecurity looked into this trend in a recent podcast episode and discovered the ease with which ChatGPT is able to create convincing, well-written phishing emails, making it more challenging to tell the difference between legitimate and malicious communication.? ?

Our curiosity about the tool led us even further. We investigated the possibility of AI writing malicious code using the 'DAN' method. After a few iterations, we were shocked to discover that the code generated was functional and could be applied to an actual attack. Watch the podcast episode to see how we did it.?

But Guess What? The Blue Team Can Use AI Too?

While AI does raise some concerns, blue teams can harness generative AI tools for defensive purposes, turning the tables on cyber threats. ?

1. Training Purposes?

Early research by our Security Lab revealed that ChatGPT is not only a potential tool for threat actors but also a resource for defenders. We obtained information that could be useful to aspiring security professionals by asking ChatGPT about the top penetration testing utilities on the market. In this example, the tool created a comprehensive tutorial on Burp Suite, which provides novice security penetration testers with practical guidance.? ?

2. Log Analysis?

Logs play a pivotal role in tracking and understanding system activities, and with the vast amount of data generation, manual analysis can become an overwhelming task. AI has the unique ability to process and comprehend various log formats from multiple sources and recognize anomalies.??

For example, threat actors often take advantage of the increased online activity during the festive season. AI algorithms can analyze historical data and identify patterns associated with attacks, allowing organizations to scale up systems and allocate resources to handle the anticipated surge in potential threats.?

3. Email Clustering for Phishing Detection?

Another area where AI shines is email clustering. AI aids in detecting phishing campaigns by grouping similar emails based on content, context, sender IP addresses, and other factors. This method goes beyond traditional reputation lists and heuristics to reveal patterns that would otherwise go unnoticed. Consider a recent case involving (the now defunct) QakBot and conversation hijacking, in which AI-assisted email clustering was critical in uncovering similarities between seemingly disparate attacks. The threat actor group exfiltrated emails from different user inboxes, so every email looked different. However, they all contained attachments or links pointing to files with similar characteristics, which AI could detect. Email Clustering is a core feature of Hornetsecurity’s Advanced Threat Protection.

4. Natural Language Processing (NLP)?

Phishing attempts frequently use psychological manipulation, urgency, and subtle language cues to trick recipients. Natural Language Processing (NLP), a dynamic subset of AI, has enormous potential to detect fraudulent emails by integrating historical data and advanced algorithms. As a result, NLP-enabled AI can serve as a proactive layer of defense, quickly identifying potential threats based on past experiences.? ?

5. Employee Training?

The use of AI extends even further to employee training. Considering that people learn differently, AI can offer a tailored approach to employee training by generating phishing training simulations based on previous employee behaviour. Hornetsecurity's Security Awareness Service puts your awareness training on autopilot. The training engine automatically rolls out the relevant learning content – individually tailored to the needs of your employees and groups. ? ?

6. Recipient Validation?

In industries like finance, healthcare, and utilities, reducing the risk of human error, such as misdirected emails, is critical to preventing security breaches. Data breaches caused by these errors not only result in significant financial losses but also harm an organization's reputation and trustworthiness. AI can guide users in selecting the correct recipients, effectively minimizing the risk of misdirected emails. Through self-learning, the AI Recipient Validation tool can continuously analyze a user's email communication patterns and automatically detect potentially unintended recipients.?

AI Predictions?

The trajectory of AI in the security space over the next few months promises to be both exciting and transformative. AI's role in cyber defense will continue to evolve, allowing organizations to forecast and proactively detect threats before they manifest. Log analysis is one area where we anticipate significant progress. AI-powered log analysis tools will become even better at detecting anomalies and patterns in complex data streams, increasing their ability to detect potential security breaches. ?

Also worth mentioning is the fact that AI vendors are starting to work directly with the cybersecurity industry. For example, OpenAI has released a grant program that incentivizes defensive tool makers to incorporate AI capabilities into their stacks. Many of these initiatives were started some months ago, so it’s likely that we’ll begin to see the fruits of those efforts in the coming days. ?

If you’re looking for more predictions - In our recent podcast episode, Andy Syrewicze and Umut Alemdar delve into several predictions as they work to uncover the bright side of AI in security. Check it out below or click here.

As AI technology advances, malicious actors will likely use it to create increasingly complex threats that are difficult to detect. As a result, while AI holds great promise for strengthening cybersecurity defenses, it also highlights the critical importance of staying one step ahead of evolving threats in the ongoing battle to protect digital assets.?