Artificial intelligence in the cyber domain: Offense and defense

symme y S S A icle A i icial In elligence in he Cybe Domain: O ense and De ense Thanh Cong T uong 1,2,*,† , Quoc Bao Diep 1,† and I an Zelinka 1,3,† 1Facul y o Elec ical Enginee ing and Compu e Science, VSB-Technical Uni e si y o Os a a, 17. lis opadu 2172/15, Os a a-Po uba, 708 00 Os a a, Czech Republic; [email p o ec ed] (Q.B.D.); [email p o ec ed] o [email p o ec ed] (I.Z.) 2Facul y o In o ma ion Technology, Uni e si y o Finance-Ma ke ing, Ho Chi Minh Ci y, Vie nam 3 Modeling E olu iona y Algo i hms Simula ion and A i icial In elligence, Facul y o Elec ical & Elec onics Enginee ing, Ton Duc Thang Uni e si y, Ho Chi Minh Ci y, Vie nam *Co espondence: [email p o ec ed] o [email p o ec ed]; Tel.: +420-774-820-835 † These au ho s con ibu ed equally o his wo k. Recei ed: 30 Decembe 2019; Accep ed: 8 Feb ua y 2020; Published: 4 Ma ch 2020   Abs ac : A i icial in elligence echniques ha e g own apidly in ecen yea s, and hei applica ions in p ac ice can be seen in many ields, anging om acial ecogni ion o image analysis. In he cybe secu i y domain, AI-based echniques can p o ide be e cybe de ense ools and help ad e sa ies imp o e me hods o a ack. Howe e , malicious ac o s a e awa e o he new p ospec s oo and will p obably a emp o use hem o ne a ious pu poses. This su ey pape aims a p o iding an o e iew o how a i icial in elligence can be used in he con ex o cybe secu i y in bo h o ense and de ense. Keywo ds: cybe secu i y; a i icial in elligence; machine lea ning; deep lea ning; bio-inspi ed compu ing; sys ems secu i y 1. In oduc ion Cybe secu i y in ol es he de ising o de ense s a egies ha p ese e compu ing esou ces, ne wo ks, p og ams, and da a om unau ho ized access, change, o des uc ion. Due o he d ama ic ad ances in in o ma ion and communica ion echnologies, new cybe secu i y h ea s a e eme ging and changing apidly. Cybe c iminals a e adop ing new and sophis ica ed echniques ha inc ease he speed and scale o hei a acks. Hence, he e is a equi emen o mo e lexible, adap able, and obus cybe de ense sys ems ha a e capable o de ec ing a wide a ie y o h ea s in eal- ime. In ecen yea s, he adop ion o a i icial in elligence (AI) echniques has been ising and main aining a c ucial ole in cybe h ea de ec ion and p e en ion. While he concep o AI was p oposed in he 1950s, in ecen yea s, i has g own a a signi ican pace and is now in luencing all aspec s o communi ies and occupa ions. Many a eas bene i om AI, such as gaming, na u al language p ocessing, heal h ca e, manu ac u ing, educa ion, and o he s. This end is also a ec ing he cybe secu i y ield whe e AI has been u ilized o bo h a acking and de ending in he cybe space. On he o ense side, cybe h ea s can employ AI o imp o e he sophis ica ion and scope o hei a acks. On he de ense side, AI is u ilized o enhance he de ense s a egies, so ha he de ense sys ems become mo e obus , lexible, and e icien , which in ol es being adap i e wi h changes in he en i onmen o dec ease he impac s occu ed. Recen ly, esea che s p esen ed se e al su eys in he domain o AI and cybe secu i y. Howe e , some o hem jus ocused on he adop ing machine lea ning me hods o cybe p oblems such as hose in [ 1 – 4 ]. O he esea ch [ 5 , 6 ] jus ocused on deep lea ning me hods. Addi ionally, he e is a lack o li e a u e dealing wi h he ne a ious use o AI. Symme y 2020,12, 410; doi:10.3390/sym12030410 www.mdpi.com/jou nal/symme y Symme y 2020,12, 410 2 o 24 Ap uzzese e al. [ 7 ] pe o med a su ey on ML and DL me hods o cybe secu i y. Ne e heless, hei esea ch was jus co e ing a acks ela ed pa icula ly o ne wo k in usion de ec ion, malwa e in es iga ion, and spam iden i ica ion. The au ho in [ 8 ] discussed he in e sec ion o AI and cybe secu i y. Mo e pa icula ly, he pape e iewed some ML and DL app oaches o coun e agains cybe a acks. Wha is mo e, he au ho in oduced he possibili y o a acking he AI model. Ne e heless, he pape jus discussed ad e sa ial a acks and igno ed o he kinds o a ack using he AI model, such as poisoning da a, and he ex ac ion model. Ano he app oach by he au ho s in [ 4 ] poin ed ou he di e ences be ween adi ional ML and DL me hods o cybe secu i y. Howe e , hei su ey jus concen a ed on in usion de ec ion. Based on he abo e ci cums ances, his su ey pape pu sues a wo- old goal. The i s is o ca y ou an explo a ion o he impac o AI in cybe secu i y. The second is o eplenish he li e a u e wi h ecen e iews on cybe applica ions o AI me hods. The main con ibu ions o his su ey a e lis ed as ollows: • To p esen he impac o AI echniques on cybe secu i y: we p o ide a b ie o e iew o AI and discuss he impac o AI in he cybe domain. • Applica ions o AI o cybe secu i y: we conduc a su ey o he applica ions o AI o cybe secu i y, which co e s a wide- ange cybe a ack ypes. • Discussion on he po en ial secu i y h ea s om ad e sa ial uses o AI echnologies: we in es iga e a ious po en ial h ea s and a acks may a ise h ough he use o AI sys ems. • Challenges and u u e di ec ions: We discuss he po en ial esea ch challenges and open esea ch di ec ions o AI in cybe secu i y. The emainde o his pape p oceeds as ollows. Sec ion 2desc ibes he esea ch me hodology. Sec ion 3p esen s a b ie o e iew o AI and discusses he ole o AI in cybe secu i y. Sec ion 4gi es a b ie o e iew o AI me hodology o cybe secu i y. Sec ion 5 ocuses on cybe applica ions o AI me hods. Sec ion 6discusses a ious po en ial h ea s ha adop AI echniques. Challenges and open esea ch di ec ions a e discussed in Sec ion 7. Sec ion 8p o ides sho discussions abou he ole o AI, and compa es ou wo k wi h exis ing su eys. Sec ion 9concludes he pape . 2. Resea ch Me hodology To ge a comp ehensi e o e iew o he junc ion be ween AI and cybe secu i y, we used ou da abases: Web o Science, Scopus, IEEE Xplo e, and ACM digi al lib a y. Alongside ha , he Google Schola sea ch engine was also u ilized. A se o keywo ds ela ed o he opic ha e been used in hese da abases. To enhance he sea ch esul s, he au ho s e ined di e en keywo ds and keywo d mix u es o each sea ch engine o ob ain he highes co e age. In a second s ep, we used a il e based on he ob ained esul s. The sea ch esul s we e limi ed only o he exis ing pape s published in he las ou yea s, because he pu pose o his pape is o disco e he mos ecen esea ch ends o AI in cybe secu i y. Nex , he esul s we e so ed by he numbe o ci a ions, and manusc ip s ha had mo e han i e ci a ions we e selec ed. On he o he hand, ecen ly published pape s which had less han i e ci a ions bu had no el app oaches we e also chosen. A e ha , he ma e ials which me he ollowing c i e ia we e excluded: •Pape s which had i les belonging o subjec s ou side he scope o his esea ch. •Books, pa en documen s, echnical epo s, ci a ions. •Pape s which we e no w i en in English. In he hi d s ep, we examined he abs ac s and he conclusions o ele an da a. Th ough his s ep, he au ho s con i med whe he he classi ied pape s ma ched he main opic o he junc ion be ween AI and cybe secu i y. Consequen ly, hose pape s which we e he mos ele an o he ask we e chosen. Symme y 2020,12, 410 3 o 24 3. The impac o AI on Cybe secu i y De ining AI can ake wo app oaches. Fi s , i is a science ha s i es o disco e he na u e o in elligence and de elop sma machines in which scien is s apply in o ma ion, logic, sel -lea ning, and de e mina ion o make machines become in elligen . To pu i simply, humans c ea e machines wi h in elligence. This in elligence can hink, lea n, decide, and wo k while ying o sol e a p oblem, as a human in ellec does. On he o he hand, scien is s de ine AI as a science ha esea ches and de elops me hods o esol ing complexi y p oblems ha a e impossible o be esol ed wi hou adop ing in elligence. Fo example, scien is s can build an AI sys em o eal- ime analysis and decision making based on eno mous amoun s o da a. In ecen yea s, AI has esul ed in ad ances in many scien i ic and echnological ields, such as compu e ized obo s, image ecogni ion, na u al language p ocesses, expe sys ems, and o he s. The apid de elopmen o compu ing echnology and he in e ne has a signi ican impac on people’s daily li es and wo k. Un o una ely, i also caused many new cybe secu i y challenging issues: Fi s , he explosion o da a makes manual analysis imp ac ical. Second, h ea s a e g owing a a high a e, which also means ha new, sho -li ed species and highly adap i e h ea s become commonplace. Thi d, a p esen , he h ea s comp omise a ious echniques o p opaga ion, in ec ion, and e asion; he e o e, hey a e ha d o de ec and p edic . Mo eo e , he expense o p e en h ea s also should be conside ed. I akes a lo o ime, money, and e o o gene a e and implemen an algo i hm. Addi ionally, employing o aining specialis s in he ield is ha d and expensi e. Wha is mo e, many h ea a ia ions eme ge and sp ead con inuously. Hence, AI-based me hods a e expec ed o cope wi h hese cybe secu i y issues. 3.1. The Posi i e Uses o AI In he ield o cybe secu i y, AI is al eady being used o ad ance de ensi e capabili ies. Based on i s powe ul au oma ion and da a analysis capabili ies, AI can be used o analyze la ge amoun s o da a wi h e iciency, accu acy, and speed. An AI sys em can ake ad an age o wha i knows and unde s and he pas h ea s o iden i y simila a acks in he u u e, e en i hei pa e ns change. Undoub edly, a i icial in elligence has se e al ad an ages when i comes o cybe secu i y in he ollowing aspec s: • AI can disco e new and sophis ica ed changes in a ack lexibili y: Con en ional echnology is ocused on he pas and elies hea ily on known a acke s and a acks, lea ing oom o blind spo s when de ec ing unusual e en s in new a acks. The limi a ions o old de ense echnology a e now being add essed h ough in elligen echnology. Fo example, p i ileged ac i i y in an in ane can be moni o ed, and any signi ican mu a ion in p i ileged access ope a ions can deno e a po en ial in e nal h ea . I he de ec ion is success ul, he machine will ein o ce he alidi y o he ac ions and become mo e sensi i e o de ec ing simila pa e ns in he u u e. Wi h a la ge amoun o da a and mo e examples, he machine can lea n and adap be e o de ec anomalous, as e , and mo e accu a e ope a ions. This is especially use ul while cybe -a acks a e becoming mo e sophis ica ed, and hacke s a e making new and inno a i e app oaches. • AI can handle he olume o da a: AI can enhance ne wo k secu i y by de eloping au onomous secu i y sys ems o de ec a acks and espond o b eaches. The olume o secu i y ale s ha appea daily can be e y o e whelming o secu i y g oups. Au oma ically de ec ing and esponding o h ea s has helped o educe he wo k o ne wo k secu i y expe s and can assis in de ec ing h ea s mo e e ec i ely han o he me hods. When a la ge amoun o secu i y da a is c ea ed and ansmi ed o e he ne wo k e e y day, ne wo k secu i y expe s will g adually ha e di icul y acking and iden i ying a ack ac o s quickly and eliably. This is whe e AI can help, by expanding he moni o ing and de ec ion o suspicious ac i i ies. This can help ne wo k secu i y pe sonnel eac o si ua ions ha hey ha e no encoun e ed be o e, eplacing he ime-consuming analysis o people. Symme y 2020,12, 410 4 o 24 • An AI secu i y sys em can lea n o e ime o espond be e o h ea s: AI helps de ec h ea s based on applica ion beha io and a whole ne wo k’s ac i i y. O e ime, AI secu i y sys em lea ns abou he egula ne wo k o a ic and beha io , and makes a baseline o wha is no mal. F om he e, any de ia ions om he no m can be spo ed o de ec a acks. AI echniques seem an up-and-coming a ea o esea ch ha enhances he secu i y measu es o cybe space. Many AI me hods a e being used o deal wi h h ea s, including compu a ional in elligence, neu al ne wo ks, in elligen agen s, a i icial immune sys ems, da a mining, pa e n ecogni ion, heu is ics, ML, DL, and o he s. Howe e , among hese echniques, ML and DL a ac ed a lo o a en ion ecen ly and ob ained he mos achie emen s in comba ing agains cybe - h ea s. 3.2. D awbacks and Limi a ions o Using AI The ad an ages highligh ed abo e a e jus a ac ion o he po en ial o how AI can assis cybe secu i y, bu he applica ion o his echnology has some limi a ions, as desc ibed below. • Da a se s: C ea ing an AI sys em demands a conside able numbe o inpu samples, and ob aining and p ocessing he samples can ake a long ime and a lo o esou ces. • Resou ce equi emen s: Building and main aining he undamen al sys em needs an immense amoun o esou ces, including memo y, da a, and compu ing powe . Wha is mo e, skilled esou ces necessa y o implemen his echnology equi e a signi ican cos . • False ala ms: F equen alse ala ms a e an issue o end-use s, dis up ing business by po en ially delaying any necessa y esponse and gene ally a ec ing e iciency. The p ocess o ine- uning is a ade-o be ween educing alse ala ms and main aining he secu i y le el. • A acks on he AI-based sys em: A acke s can use a ious a ack echniques ha a ge AI sys ems, such as ad e sa ial inpu s, da a poisoning, and model s ealing. One impo an aspec o be aken in o accoun is he ne a ious use o AI. This echnology will also be used as a way o imp o e h ea s. Fo example, malicious ac o s can le e age he ML echnique o gene a e a ha d- o-de ec malwa e a ian wi h machine speed. Wha is mo e, AI migh be able o pe sonalize he phishing scheme be e and aise he scale o he a ack, making he a ack mo e likely o succeed. Mo e de ail abou his ma e discussed in Sec ion 6. 4. AI Me hodology o Cybe secu i y In his sec ion, he au ho s gi e an o e iew o he lea ning algo i hms, an essen ial concep o AI. Fu he mo e, we p esen a b ie in oduc ion abou ML, DL, and bio-inspi ed compu a ion me hods ha a e equen ly u ilized in he a ea o cybe secu i y. 4.1. Lea ning Algo i hms AI is a b anch o compu e science ha seeks o p oduce a new ype o in elligen au oma on ha esponds like human in elligence. To achie e his goal, machines need o lea n. To be mo e p ecise, we need o ain he compu e by using he lea ning algo i hms. Gene ally, lea ning algo i hms help o enhance pe o mance in accomplishing a ask h ough lea ning and aining om expe ience. The e a e cu en ly h ee majo ypes o lea ning algo i hms which we use o ain machines: • Supe ised lea ning: This ype equi es a aining p ocess wi h a la ge and ep esen a i e se o da a ha has been p e iously labeled. These lea ning algo i hms a e equen ly used as a classi ica ion mechanism o a eg ession mechanism. • Unsupe ised lea ning: In con as o supe ised lea ning, unsupe ised lea ning algo i hms use unlabeled aining da ase s. These app oaches a e o en used o clus e da a, educe dimensionali y, o es ima e densi y. • Rein o cemen lea ning: Rein o cemen lea ning is a ype o lea ning algo i hm ha lea ns he bes ac ions based on ewa ds o punishmen . Rein o cemen lea ning is use ul o si ua ions whe e da a is limi ed o no gi en. Symme y 2020,12, 410 5 o 24 4.2. Machine Lea ning Me hods Machine lea ning (ML) is a b anch o AI ha aims o empowe sys ems by u ilizing da a o lea n and imp o e wi hou being explici ly p og ammed. ML has s ong ies o ma hema ical echniques ha enable a p ocess o ex ac ing in o ma ion, disco e ing pa e ns, and d awing conclusions om da a. The e a e di e en ypes o he ML algo i hm, bu hey can gene ally be classi ied in o h ee main ca ego ies: supe ised lea ning, unsupe ised lea ning, and ein o cemen lea ning. In he compu e secu i y domain, he s anda d ML algo i hms a e decision ees (DT), suppo ec o machines (SVM), Bayesian algo i hms, k-nea es neighbo (KNN), andom o es (RF), associa ion ule (AR) algo i hms, ensemble lea ning (EL), k-means clus e ing, and p incipal componen analysis (PCA). 4.3. Deep Lea ning Me hods Deep lea ning (DL) is a sub- ield o ML, and i uses da a o each compu e s how o do hings only humans a e capable o a ha ime. I s mo i a ion lies in he wo king mechanisms o he human b ain and neu ons o p ocessing signals. The co e o deep lea ning is ha i we cons uc mo e ex ensi e neu al ne wo ks and ain hem wi h as much da a as possible, hei pe o mance con inues o inc ease. The mos impo an ad an age o DL o e he con en ional ML is i s supe io pe o mance in la ge da ase s. Simila ly o ML me hods, DL me hods also ha e supe ised lea ning, unsupe ised lea ning, and ein o cemen lea ning. The bene i o DL is he le e age o unsupe ised lea ning o selec ea u e au oma ically. The ypical DL algo i hms equen ly u ilized in he cybe secu i y domain a e: eed o wa d neu al ne wo ks (FNN), con olu ional neu al ne wo ks (CNNs), ecu en neu al ne wo ks (RNN), deep belie ne wo ks (DBNs), s acked au oencode s (SAE), gene a i e ad e sa ial ne wo ks (GANs), es ic ed Bol zmann machines (RBMs), and ensemble o DL ne wo ks (EDLNs). 4.4. Bio-Inspi ed Compu a ion Me hods Bio-inspi ed compu a ion is a b anch o AI which eme ged as one o he mos s udied du ing ecen yea s. I is a collec ion o in elligen algo i hms and me hods ha adop bio-inspi ed beha io s and cha ac e is ics o sol e a wide ange o complex academic and eal domain p oblems. Among many biological-inspi ed me hods, he ollowing echniques a e mos commonly used in he cybe secu i y domain: gene ic algo i hms (GA), e olu ion s a egies (ES), an colony op imiza ion (ACO), pa icle swa m op imiza ion (PSO), and a i icial immune sys ems (AIS). 5. AI-Based App oaches o De ending Agains Cybe space A acks Recen ly, scien is s p oposed nume ous echniques ha ha e u ilized AI me hods o de ec o ca ego ize malwa e, de ec ne wo k in usions, phishing, and spam a acks; coun e Ad anced pe sis en h ea (APT); and iden i y domain gene a ed by doamain gene a ion algo i hms (DGAs). In his sec ion, we ca ego y hese li e a u e in o ou main g oups: malwa e iden i ica ion; ne wo k in usion de ec ion; phishing and SPAM iden i ica ion; and o he , which comp omises coun e ing APT and iden i ying DGAs. Figu e 1illus a es he p ima y a eas o u ilizing AI o cybe secu i y. Symme y 2020,12, 410 6 o 24 Cybe Applica ions o AI-base me hods Malwa e de ec ion Ne wo k in usion Phishing/Spam de ec ion PC malwa e And oid malwa e O he In usion de ec ion Anomaly de ec ion Web phishing de ec ion Mail phishing de ec ion Spam mail Spam on social ne wo ks Coun e ing APTs Iden i y domain names gene a ed by DGAs Figu e 1. Main b anches o cybe secu i y applica ions adop ing AI echniques. 5.1. Malwa e Iden i ica ion Malwa e is a gene al e m o many ypes o malicious so wa e, such as i uses, wo ms, ojan ho ses, exploi s, bo ne , e o i uses, and oday, malwa e is a popula me hod o cybe -a ack. Malwa e’s impac on digi al socie y is eno mous, so a conside able amoun o esea ch abou adop ing AI echniques has been done o p e en and mi iga e malwa e. The mos ecen and no ewo hy con ibu ions u ilize in elligence o malwa e de ec ion and p e en ion—desc ibed as ollows. In [ 9 ], he au ho s adop ed ML o c ea e an online amewo k o ha dwa e-assis ed malwa e de ec ion based on i ual memo y access pa e ns. The p oposed me hod used logis ic eg ession, a suppo ec o machine, and a andom o es classi ie , and pe o med on he RIPE benchma k sui e o he expe imen s. The au ho s epo ed ha he amewo k has a ue posi i e a e o 99% wi h a less han 5% alse posi i e a e. Meanwhile, he schola s in [ 10 ] p esen ed a amewo k o classi ying and de ec ing malicious so wa e using da a mining and ML classi ica ion. In ha wo k, bo h signa u e-based and anomaly-based ea u es we e analyzed o de ec ion. Expe imen al esul s showed ha he p oposed me hod ou pe o med o he simila me hods. Ano he app oach [ 11 ] used ope a ional codes (OpCode), k-nea es neighbo s (KNN), and a suppo ec o machine (SVM) as ML classi ie s o classi y malwa e. The OpCode was ep esen ed as a g aph and embedded in o eigenspace; hen, one classi ie o an ensemble o classi ie s we e u ilized o classi y each ec o as malwa e o benign. The empi ical esul showed ha he p oposed model is e icien wi h a low alse ala m a e and high de ec ion a e. La e , Ye e al. [ 12 ] buil a deep lea ning a chi ec u e o in elligen malwa e de ec ion. In his wo k, hey u ilized an Au oEncode s acked up wi h mul ilaye es ic ed Bol zmann machines (RBMs) Symme y 2020,12, 410 7 o 24 o de ec unknown malwa e. The au ho claimed ha he e ogeneous deep lea ning amewo k could imp o e he o e all pe o mance in malwa e de ec ion compa ed wi h adi ional shallow lea ning me hods and deep lea ning me hods. A ecen end o esea ch in malwa e de ec ion ocused on mobile malwa e in gene al and And oid malwa e in pa icula . Machine lea ning, along wi h deep lea ning, was a signi ican b eak h ough in his a ea. In [ 13 ], a deep con olu ional neu al ne wo k (CNN) was adop ed o iden i y malwa e. The aw opcode sequence om a disassembled p og am was used o classi y malwa e. The au ho s in [ 14 ] u ilized a suppo ec o machine (SVM) and he mos signi ican pe missions om all o he pe mission da a o dis inguish be ween benign and malicious apps. In [ 15 ], he au ho s p esen ed no el ML algo i hms, namely, o a ion o es , o malwa e iden i y. An a i icial neu al ne wo k (ANN) and he aw sequences o API me hod calls we e u ilized in [ 16 ] o de ec And oid malwa e. A ecen s udy by Wang e al. [ 17 ] in oduced a hyb id model based on deep au oencode (DAE) and a con olu ional neu al ne wo k (CNN) o aise he accu acy and e iciency o la ge-scale And oid malwa e de ec ion. Ano he esea ch di ec ion ha a ac ed he a en ion o scien is s was he use o bio-inspi ed me hods o malwa e classi ica ion. These echniques we e mainly used o ea u e op imiza ion and op imizing he pa ame e o he classi ie s. Fo example, pa icle swa m op imiza ion (PSO) was adop ed in [ 18 – 20 ]; he gene ic algo i hm (GA) was u ilized in [ 21 , 22 ] o enhance he e ec i eness o a malwa e de ec ion sys em. Table 1abs ac s some cha ac e is ics o he discussed malwa e iden i ica ion app oaches, conce ning he ocus a eas, echniques, ea u es, da ase s, and alida ion me ics used o e alua e he models’ pe o mances. Fo he alida ion me ics, we p esen he bes pe o ming me hod in he pape . Fo he mul i- ask model, we p esen he e alua ion measu es o all asks, i hey exis , gi en by he "/" symbol. The ac onyms o his able a e desc ibed in Table 2. Table 1. Selec ed li e a u e o AI-based app oaches in malwa e in es iga ion. Re e ences Yea Focus Tech. Fea u es Da ase Valida ion Me ics [9] 2017 PC malwa e SVM,RF Logis ic eg ession MAP’s ea u e se s RIPE DR: 99% FPR: 5% [10] 2017 PC malwa e BAM, MLP N-g am, Windows API calls Sel collec ion: 52,185 samples ACC: 98.6% FPR: 2% [11] 2017 PC malwa e KNN, SVM OpCode g aph Sel collec ion: 22,200 samples ACC, FPR [13] 2017 And oid malwa e CNN Opcode sequence GNOME, McA ee Labs ACC: 98%/80%/87%, F-sco e: 97%/78%/86% [19] 2017 And oid malwa e ANF, PSO Pe missions, API Calls Sel collec ion: 500 samples ACC: 89% [21] 2017 Bo ne C4.5, GA Mul i ea u es ISOT , ISCX DR: 99.46%/95.58% FPR: 0.57%/ 2.24% [12] 2018 PC malwa e Au oEncode , RBM Windows API calls Sel collec ion: 20,000 samples ACC: 98.2% [14] 2018 And oid malwa e SVM, DT Signi ican pe missions Sel collec ion: 54,694 samples ACC: 93.67% FPR: 4.85% [15] 2018 And oid malwa e Ro a ion Fo es Pe missions, APIs, sys em e en s Sel collec ion: 2,030 smaples ACC: 88.26% [16] 2018 And oid malwa e ANN API call Malgenome, D ebin, Maldoze F1-Sco e: 96.33% FPR: 3.19% [18] 2018 And oid malwa e PSO, RF, J48, KNN, MLP, AdaBoos Pe missions Sel collec ion: 8500 samples TPR: 95.6% FPR: 0.32% Symme y 2020,12, 410 8 o 24 Table 1. Con . Re e ences Yea Focus Tech. Fea u es Da ase Valida ion Me ics [17] 2019 And oid malwa e DAE, CNN Pe missions, il e ed in en s, API calls, ha dwa e ea u es, code ela ed pa e ns Sel collec ion: 23000 samples ACC: 98.5%/98.6% FPR: 1.67%/1.82% [20] 2019 And oid malwa e PSO, Bayesne , Naï e Bayes, SMO, DT, RT, RF J48, MLP Pe missions UCI, KEEL, Con agiodump, Wang’s eposi o y ACC: 79.4%/47.6%/ 82.9%/94.1%/ 100%/77.9% [22] 2019 And oid malwa e SVM, ANN App Componen s, Pe missions Sel collec ion: 44,000 samples ACC: 95.2%/96.6% Table 2. The ac onyms used in Table 1. ACC: Accu acy FPR: False posi i e a e DR: De ec ion a e RF: Random o es SVM: Suppo ec o machine MLP: mul ilaye pe cep on BAM: bina y associa i e memo y KNN: k-nea es neighbo s CNN: Con olu ional neu al ne wo k ANF: Adap i e neu al uzzy GA: Gene ic Algo i hm RBMs: Res ic ed Bol zmann machines DT: Decision ee GP: Gene ic p og amming DT: decision ee DAE: Deep au o-encode 5.2. In usion De ec ion An in usion de ec ion sys em (IDS) is a sys em ha is supposed o p o ec he sys em om possible inciden s, iola ions, o imminen h ea s. AI-based echniques a e app op ia e o de eloping IDS, and ou pe o m o he echniques because o hei lexibili y, adap abili y, apid calcula ions, and quick lea ning. Hence, many esea che s s udied in elligen me hods o imp o e he pe o mance o IDS. The ocus was on de eloping op imized ea u es and imp o ing he classi ie s o educe he alse ala ms. Some ecen no able s udies a e lis ed as ollows. Al-Yaseen e al. [ 23 ] combined a suppo ec o machine (SVM) and an ex eme lea ning machine wi h modi ied k-means as a model o IDS. Using he KDD’99 Cup da ase , hei model a chi ed a esul o up o 95.75% accu acy and 1.87% alse ala ms. Meanwhile, Kabi e al. [ 24 ] in oduced a me hod o an in usion de ec ion sys em based on sampling wi h a leas squa e suppo ec o machine (LS-SVM). The p oposed me hodology was alida ed h ough he KDD’99 Cup da ase and ob ained a ealis ic pe o mance in e ms o accu acy and e iciency. The au ho s in [ 25 ] in oduced a uzziness based semi-supe ised lea ning app oach o IDS. In hei wo k, hey u ilized unlabeled samples assis ed wi h a supe ised lea ning algo i hm o enhance he pe o mance o he classi ie . The algo i hm was es ed on he KDD’99 Cup da ase and ou pe o med o he compa a i e algo i hms. La e , Shone e al. [ 26 ] p oposed a no el deep lea ning-based in usion de ec ion me hod called nonsymme ic deep au oencode (NDAE). The au ho s used Tenso Flow and e alua ed hei me hod by using KDD Cup ’99 and NSL-KDD da ase s. They ha e claimed ha hei model achie ed an accu acy o 97.85%. Ano he app oach using gene ic algo i hms (GA) and uzzy logic o ne wo k in usion de ec ion is p esen ed by Hamamo o e al. [ 27 ]. The GA is used o c ea e a digi al signa u e o a ne wo k segmen using glow analysis (DSNSF), a p edic ion o he ne wo k’s a ic beha io o a gi en ime in e al. Addi ionally, he uzzy logic app oach is adop ed o assess whe he an ins ance ep esen s an anomaly o no . The e alua ion was conduc ed by using eal ne wo k a ic om a uni e si y and ob ained an accu acy o 96.53% and a alse ala m o 0.56%. One poin o be aken in o accoun is ha he use o swa m in elligence (SI) o IDS. Bo es e al. [28] p esen ed a new me hod, namely, an ee mine (ATM) classi ica ion, which is a decision ee Symme y 2020,12, 410 9 o 24 using ACO ins ead o con en ional echniques, such as C4.5 and CART [ 29 ], o in usion de ec ion. Using NSL-KDD da ase s, hei app oach achie ed he accu acy o 65% and a alse ala m a e p 0%. In a la e s udy [ 30 ], he au ho s p esen ed an IDS using bina y PSO and KNN. The p oposed me hod consis s o ea u e selec ion and classi ica ion s eps. Based on he esul s ob ained, he algo i hm showed excellen pe o mance, and he p oposed hyb id algo i hm aised he accu acy gene a ed by KNN by up o 2%. Meanwhile, Ali e al. [ 31 ] in oduced a lea ning model o a as lea ning ne wo k (FLN) based on PSO named PSO-FLN, and hen he model was u ilized o he p oblem o IDS. The PSO-FLN model was es ed on he KDD’99 Cup da ase s and achie ed he highes es ing accu acy compa ed o o he me a-heu is ic algo i hms. In he ecen s udy by Chen e al. [ 32 ], a mul i-le el adap i e coupled in usion de ec ion me hod combining whi e lis echnology and machine lea ning was p esen ed. The whi e lis was used o il e he communica ion, and he machine lea ning model was used o iden i y abno mal communica ion. In his a icle, he adap i e PSO algo i hm and he a i icial ish swa m (AFS) algo i hm we e used o op imize he pa ame e s o he machine lea ning model. The me hod was es ed on KDD’99 Cup, Gas Pipeline, and indus ial ield da ase s. The empi ical esul showed ha he p oposed model is e icien wi h a ious a ack ypes. In [ 33 ], he au ho s in oduced he Fuzzi ied Cuckoo based clus e ing echnique o anomaly de ec ion. The echnique consis s o wo phases: he aining phase and he de ec ion phase. In he aining phase, cuckoo sea ch op imiza ion (CSO), k-means clus e ing, and decision ee c i e ion (DTC) we e combined o e alua e he dis ance unc ions. In he de ec ion phase, a uzzy decisi e app oach was u ilized o iden i y he anomalies based on inpu da a and p e iously compu ed dis ance unc ions. Expe imen al esul s showed ha he model was e ec i e wi h an accu acy a e o 97.77% and a alse ala m a e o 1.297%. Meanwhile, he au ho s in [ 34 ] inco po a ed a i icial bee colony and a i icial ish swa m algo i hms o cope wi h he complex IDS p oblems. In his wo k, a hyb id classi ica ion me hod based on he ABC and AFS algo i hms was p oposed o imp o e he de ec ion accu acy o IDS. The NSL-KDD and UNSW-NB15 da ase s we e used o e alua e he pe o mance o he me hod. Based on he esul s ob ained, he p oposed model was e icien wi h a low alse ala m a e and high accu acy a e. In la e esea ch, Ga g e al. [ 35 ] p oposed a hyb id model o ne wo k anomaly de ec ion in cloud en i onmen s. The model u ilized g ay wol op imiza ion (GWO) and a con olu ional neu al ne wo k (CNN) o ea u e ex ac ion and iden i ying he anomalies in eal- ime ne wo k a ic s eams. The empi ical esul showed ha he p oposed model was e icien wi h a low alse ala m a e and high de ec ion a e. Ano he app oach [ 36 ] p esen ed a hyb id IDS u ilizing spa k ML and he con olu ional-LSTM ne wo k. The ISCX-UNB da ase was used o e alua e he pe o mance o he me hod. Based on he esul s ob ained, he p oposed model ob ained a signi ican esul and ou pe o med he compa ed me hod. In e e ence [ 37 ], he au ho s adop ed he i e ly algo i hm o ea u e selec ion and he C4.5 Bayesian ne wo ks classi ie o de ec ion ne wo k in usion. The p oposed app oach was es ed on he KDD’99 Cup da ase , and ob ained a p omising esul and ou pe o med he compa ed me hod o ea u e selec ion. Recen ly, esea ch conduc ed by Gu e al. [ 38 ] in oduced an IDS based on SVM wi h he abu-a i icial bee colony o ea u e selec ion and pa ame e op imiza ion simul aneously. The main con ibu ions o hei wo k included he adop ing o he abu sea ch algo i hm o imp o e he neighbo hood sea ch o ABC, so ha i could speed up he con e gence and p e en ge ing s uck in he local op imum. Acco ding o hei expe imen s, al hough he accu acy a e was high, 94.53%, he alse ala m a e was 7.028%. Table 3abs ac s some cha ac e is ics o he discussed ne wo k in usion de ec ion app oaches, conce ning he ocus a eas, echniques, ea u es, he da ase s, and alida ion me ics used o e alua e Symme y 2020,12, 410 16 o 24 6.1.2. AI Used in Social Enginee ing A acks AI can be le e aged o mine la ge amoun s o big da ase s con aining social ne wo k da a o ex ac pe sonally iden i iable in o ma ion, which can be used o comp omising use accoun s. Wha is mo e, based on use in o ma ion, malicious ac o s could adop AI o gene a e cus om malicious links o c ea e pe sonalized phishing emails au oma ically. The e ha e been s udies on adop ing AI o ca y ou complex social enginee ing a acks. In [ 66 , 67 ], he au ho s in oduced a long sho - e m memo y (LSTM) neu al ne wo k ha was ained on social media pos s o manipula e use s in o clicking on decep i e URLs. 6.2. AI as a Tool o A acking AI Models As AI is being in eg a ed in o secu i y solu ions, cybe c iminals a emp o exploi ulne abili ies in his domain. A acks on AI sys ems a e ypically discussed in he con ex o ad e sa ial machine lea ning. The o enses on AI sys ems o en appea ed in h ee a eas: • Ad e sa ial inpu s: This is a echnique whe e malicious ac o s design he inpu s o make models p edic e oneously in o de o e ade de ec ion. Recen s udies demons a ed how o gene a e ad e sa ial malwa e samples o a oid de ec ion. The au ho s o [ 68 , 69 ] c a ed ad e sa ial examples o a ack he And oid malwa e de ec ion model. Meanwhile, schola s in [ 70 ] p esen ed a gene a i e ad e sa ial ne wo k (GAN) based algo i hm called MalGAN o c a ad e sa ial samples, which was capable o bypassing black-box machine lea ning-based de ec ion models. Ano he app oach by Ande son e al. [ 71 ] adop ed GAN o c ea e ad e sa ial domain names o a oid he de ec ion o domain gene a ion algo i hms. The au ho s in [ 72 ] in es iga ed ad e sa ial gene a ed me hods o a oid de ec ion by DL models. Meanwhile, in [ 73 ], he au ho s p esen ed a amewo k based on ein o cemen lea ning o a acking s a ic po able execu able (PE) an i-malwa e engines. • Poisoning aining da a: In his kind o a ack, he malicious ac o s could pollu e he aining da a om which he algo i hm was lea ning in such a way ha educed he de ec ion capabili ies o he sys em. Di e en domains a e ulne able o poisoning a acks; o example, ne wo k in usion, spam il e ing, o malwa e analysis [74,75]. • Model ex ac ion a acks: These echniques a e used o econs uc he de ec ion models o eco e aining da a ia black-box examina ion [ 76 ]. On his occasion, he a acke lea ns how ML algo i hms wo k by e e sing echniques. F om his knowledge, he malicious ac o s know wha he de ec o engines a e looking o and how o a oid i . Table 9desc ibes he main de ails o he selec ed s udies ocusing on malicious use o AI, wi h ega d o he ocus a ea, he echniques, he inno a ion poin , and he main idea. The ac onyms o his able a e gi en in Table 10. Symme y 2020,12, 410 17 o 24 Table 9. Selec ed e e ences in e m o he malicious use o AI. Re e ences Yea Focus Tech. Inno a ion Poin Main Idea [71] 2016 Ad e sa ial a acks GAN New a ack model c ea e ad e sa ial domain names o a oid he de ec ion o domain gene a ion algo i hms [76] 2016 S ealing model AE model ex ac ion a acks ex ac a ge ML models by he machine lea ning p edic ion APIs [66] 2016 Social enginee ing a acks RNN New a ack model Au oma ed spea phishing campaign gene a o o social ne wo k [63] 2017 Comp omise compu e Encoding DNAs Encoding malwa e o DNAs comp omise he compu e by encoding malwa e in a DNA sequence [68] 2017 Ad e sa ial a acks AE New a ack algo i hm ad e sa ial a acks agains deep lea ning based And oid malwa e classi ica ion [69] 2017 Ad e sa ial a acks AE New a ack algo i hm use he ad e sa ial examples me hod o conduc new malwa e a ian s o malwa e de ec o s [70] 2017 Ad e sa ial a acks GAN New a ack model p esen a GAN based algo i hm o c a malwa e ha capable o bypass black-box machine lea ning-based de ec ion models [61] 2018 Malwa e c ea ion DNN AI-powe ed malwa e Le e age deep neu al ne wo k enhance malwa e, make i mo e e asi e and high a ge ing [62] 2018 Malwa e c ea ion GAN AI-powe ed malwa e a oid de ec ion by simula ing he beha io s o legi ima e applica ions [64] 2018 Malwa e c ea ion ACO SI-based malwa e use ACO algo i hms o c ea e a p o o ype malwa e ha ha e a decen alize beha io [73] 2018 Ad e sa ial a acks AL New a ack me hod a gene ic black-box o a acking s a ic po able execu able machine lea ning malwa e models [72] 2018 Ad e sa ial a acks AM New a ack algo i hm ad e sa ial gene a ed me hods o a ack neu al ne wo k-based malwa e de ec ion [74] 2018 Poisoning a ack EPD New poisoning da a me hod p esen a no el poisoning app oach ha a ack agains machine lea ning algo i hms used in IDSs [75] 2018 Poisoning a ack AM Analysis poisoning da a me hod p esen h ee kind o poisoning a acks on machine lea ning-based mobile malwa e de ec ion [67] 2018 Social enginee ing a acks LSTM New a ack model in oduced a machine lea ning me hod o manipula e use s in o clicking on decep i e URLs [65] 2019 Malwa e c ea ion ANN nex gene a ion malwa e use swa m base in elligence, neu al ne wo k o o m a new kind o malwa e Table 10. The ac onyms used in Table 9. GAN: Gene a i e ad e sa ial ne wo k AE: Ad e sa ial Examples SI: Swa m In elligen ANN: A i icial Neu al Ne wo k RL: Rein o cemen lea ning AMB: Ad e sa ial Malwa e Bina ies EPD: Edge pa e n de ec ion RNN: Recu en neu al ne wo k DNN: Deep neu al ne wo k ACO: An colony op imiza ion AM: Ad e sa ial machine lea ning LSTM: Long sho e m memo y 7. Challenges and Open Resea ch Di ec ions In his sec ion, we discuss he challenges when adop ing AI-based app oaches in p ac ice. Addi ionally, we also o e a ision abou some a eas ha need o be u he esea ch. 7.1. Challenges AI me hods ha e played a c ucial ole in cybe secu i y applica ions and will con inue in a p omising di ec ion ha a ac s in es iga ions. Howe e , some issues mus be conside ed when applying AI-based echniques in cybe secu i y. Fi s , he accu acy o AI models is a signi ican ba ie . Symme y 2020,12, 410 18 o 24 Speci ically, alse ala ms can was e p ocessing ime, o an AI sys em migh miss a cybe a ack en i ely. Ano he ba ie o adop ion is ha many o he app oaches p oposed oday a e model- ee me hods. These models equi e a la ge quan i y o aining da a, which a e ha d o ob ain in eal cybe secu i y p ac ice. Nex , in designing AI-based solu ions o cybe secu i y, app oaches need o conside he ad e sa y. Ad e sa ial a acks a e ha d o de ec , p e en , and coun e agains as hey a e pa o a ba le be ween AI sys ems. AI can help p o ec he sys em agains cybe - h ea s bu can also acili a e dange ous a acks; i.e., AI-based a acks. Malicious ac o s can le e age AI o make a acks lexible and mo e sophis ica ed o bypass de ec ion me hods o pene a e compu e sys ems o ne wo ks. 7.2. Open Resea ch Di ec ions The e a e di e se p omising and open opics o inco po a ing AI echniques and cybe secu i y. Some esea ch a eas a e as ollows. Fi s , he combina ion o se e al AI-based echniques in a de ense solu ion may s ill an in e es ing esea ch di ec ion. Fo example, he inco po a ion o bio-inspi ed compu a ion and ML/DL app oaches shows p omising esul s in malwa e de ec ion [ 18 – 22 ] o [ 36 – 38 ] o de ec ing he ne wo k in usion. Hence, he combina ion o hese wo echniques is a e y po en ial esea ch di ec ion due o he numbe o bio-inspi ed algo i hms exploi ed in cybe secu i y s ill being limi ed. Second, he co po a ion be ween a human in ellec and machines o cybe de ense also needs s udy. In his human–machine model, he agen s will au onomously execu e he ask whils humans can supe ise and in e ene only when necessa y. Thi d, he e is li e a u e p o ing ha he h ea ac o s could u ilize he AI-based me hod o bypass o a ack he AI models, such as in [ 68 – 72 , 75 – 77 ]. Hence, he de ense s a egy agains hese ypes o a acks would be an ine i able end in he u u e. Ano he aspec ha necessi a es being s udied is he use o AI in malwa e, such as in [ 61 , 64 , 65 ]. Speci ically, he combina ion o swa m communica ion and o he AI-based echniques. Such malwa e will exhibi ex emely high obus ness o in o ma ion p ese a ion agains swa m ne wo k damage. Swa m communica ion also exposes he esea ch di ec ion o apply his idea o o he malwa e, such as wo ms, ojans, o ansomwa e so ha hei ac i i ies can be mo e dis ibu ed and s eal h. 8. Discussion The u iliza ion o AI in cybe secu i y c ea es new on ie s o secu i y in es iga ions. Scien is s iew AI as an essen ial esponse o he con inuous g ow h in he numbe o and he inc ease in he complexi y o cybe - h ea s, and he need o a quick eac ion and subs an ially au oma ic esponses o secu i y a acks. On he o he hand, AI echnology also leads o some secu i y issues ha need o be esol ed. In his sec ion, we summa ize he essen ial poin s in his s udy. O he me hods o enhance cybe secu i y a e also men ioned. To conclude, he au ho s compa ed his s udy wi h se e al exis ing su eys. I is clea om he li e a u e ha AI-based app oaches could be adop ed in he cybe domain, encompassing a a ie y o me hods ha ha e de eloped o e many decades, ha e demons a ed e ec i eness, and a e cu en ly in use. A p esen , he p ime a ge s o AI applica ions a e malwa e classi ica ion and analysis, in usion de ec ion ( ocusing on anomaly ne wo k-based a acks), phishing and spam, and ad anced pe sis en h ea de ec ion and cha ac e iza ion. Fu he mo e, a apidly eme ging opic o applica ion is au oma ed ulne abili y es ing and in usion esis ance. In usion de ec ion sys ems ypically ely on hyb idiza ion echniques ha combine se e al me hods: signa u e-based me hods o apid de ec ion o known h ea s wi h low alse ala m a es and anomaly-based me hods o lag de ia ions. Wha is mo e, ano he end is combining wi h o he compu a ional in elligen models, such as ACO and PSO. Symme y 2020,12, 410 19 o 24 The absence o da ase s o esea ch and de elopmen in ne wo k in usion is a p oblem. P ecisely, publicly a ailable da ase s a e ex emely da ed, such as DARPA (1998), KDD (1999), and NSL-KDD (2009), and he cha ac e is ics and olume o a acks ha e signi ican ly changed since ha ime. Wha is mo e, he majo i y use o hese da ase s may o e a one-sided ision abou collec ed da a and no e lec eal-wo ld si ua ions. The e a e indica ions ha AI-based models can be bypassed. Se e al published examples in he cybe secu i y ield indica e ha he AI sys em can be challenged wi h he ad e sa ial inpu s o poisoning he aining da a. Fu he mo e, he po en ial h ea s o malicious use o AI need o be aken in o accoun . Fo example, AI echnology can be u ilized o powe malwa e, es ablish a spea -phishing campaign, o pe o m a social enginee ing a ack. Besides hose p e iously men ioned opics, o he esea ch di ec ions o enhance cybe secu i y we e also paid a en ion. Fo ins ance, in [ 78 ] he au ho s conduc ed a su ey abou he use o Kolmogo o complexi y in he secu i y and p i acy domains. The adop ion o hese echnologies in he cybe secu i y ealm was inspi ed by he ea u e ee na u e, and he absence o a need o une he pa ame e s. In his wo k, we e iewed di e en AI echniques and me hods used in de ending agains cybe - h ea s a acks and o e ed a ision o malicious use o AI echnology as po en ial h ea s. In o de o ensu e he no el y and new con ibu ion o ou su ey, we ho oughly compa ed ou wo k wi h exis ing su eys, as shown in Table 11. Table 11. A compa ison be ween ou su eys and exis ing su eys in he li e a u e. Con en Yea Re e ences [7] [8] [6] [3] [4] [5] [2]This Su ey 2018 2018 2018 2018 2018 2019 2019 2019 AI me hods Machine lea ning x x x x x x Deep lea ning x x x x x x Bio-inspi e compu ing x x De ense applica ions Malwa e de ec ion x x x x x x x x In usion de ec ion x x x x x x x Phishing de ec ion x x x x x x Spam iden i ica ion x x x x x APTs de ec ion x x x x DGAs de ec ion x x x x Malicous use o AI Ai-powe d malwa e x x A ack agains AI x x x x Social enginee ing a acks x x 9. Conclusions D ama ic ad ances in in o ma ion echnology ha e led o he eme gence o new challenges o cybe secu i y. The compu a ional complexi y o cybe -a acks equi es new app oaches which a e mo e obus , scalable, and lexible. This a icle ocuses on he applica ion o he AI-based echnique in cybe secu i y issues. Speci ically, we p esen he applica ion o AI in malwa e de ec ion, in usion de ec ion, APT, and o he domains, such as spam de ec ion and phishing de ec ion. Fu he mo e, ou manusc ip o e s a ision o how AI could be adop ed o malicious use. In con empo a y esea ch, he p ima y a ge s o AI applica ion in cybe secu i y a e ne wo k in usion de ec ion, malwa e analysis and classi ica ion, phishing, and spam emails. In hose a eas, he adop ion o DL g adually became he p ima y end. Fu he mo e, he combina ion o o he in elligen echniques, such as bio-inspi ed me hods, oge he wi h ML/DL, also a ac ed he a en ion o esea che s. Such combina ions yield e y p omising esul s and con inue a end o u he esea ch. Al hough he ole o AI in esol ing cybe secu i y ma e s con inues o be esea ched, some o he p oblems ha exis a ound he deploymen o AI-based de enses a e also s iking. Fo ins ance, Symme y 2020,12, 410 20 o 24 he ad e sa ial a ack agains he AI models o he eme gence o au onomous in elligen malwa e. Hence, esea ch on disco e ing solu ions o hese h ea s should be u he explo ed. Au ho Con ibu ions: All he au ho s a e esponsible o he concep o he pape , he esul s p esen ed, and he w i ing, and con ibu ed equally o his wo k. All au ho s ha e ead and ag eed o he published e sion o he manusc ip . Funding: This esea ch ecei ed no ex e nal unding. Acknowledgmen s: The ollowing g an s a e acknowledged o he inancial suppo p o ided o his esea ch: g an o SGS, numbe SP2020/78, VSB Technical Uni e si y o Os a a. Con lic s o In e es : The au ho s decla e no con lic o in e es . Abb e ia ions The ollowing abb e ia ions a e used in his manusc ip : AI A i icial in elligence ML Machine lea ning DL Deep lea ning DT Decision ees SVM Suppo ec o machines KNN K-nea es neighbo RF Random o es AR Associa ion ule algo i hms EL Ensemble lea ning PCA P incipal componen analysis FNN Feed o wa d neu al ne wo ks CNNs Con olu ional neu al ne wo ks RNN Recu en neu al ne wo ks DBNs Deep belie ne wo ks SAE S acked au oencode s GANs Gene a i e ad e sa ial ne wo ks RBMs Res ic ed Bol zmann machines EDLNs Ensemble o deep lea ning ne wo ks GA Gene ic algo i hms ES E olu ion s a egies ACO An colony op imiza ion PSO Pa icle swa m op imiza ion AIS A i icial immune sys ems (AIS) Re e ences 1. Buczak, A.L.; Gu en, E. A su ey o da a mining and machine lea ning me hods o cybe secu i y in usion de ec ion. IEEE Commun. Su . Tu o . 2015,18, 1153–1176. [C ossRe ] 2. To es, J.M.; Comesaña, C.I.; Ga cía-Nie o, P.J. Machine lea ning echniques applied o cybe secu i y. In . J. Mach. Lea n. Cybe n. 2019, 1–14. [C ossRe ] 3. Guan, Z.; Bian, L.; Shang, T.; Liu, J. When machine lea ning mee s secu i y issues: A su ey. In P oceedings o he 2018 IEEE In e na ional Con e ence on In elligence and Sa e y o Robo ics (ISR), Shenyang, China, 24–27 Augus 2018; pp. 158–165. 4. Xin, Y.; Kong, L.; Liu, Z.; Chen, Y.; Li, Y.; Zhu, H.; Gao, M.; Hou, H.; Wang, C. Machine lea ning and deep lea ning me hods o cybe secu i y. IEEE Access 2018,6, 35365–35381. [C ossRe ] 5. Be man, D.S.; Buczak, A.L.; Cha is, J.S.; Co be , C.L. A su ey o deep lea ning me hods o cybe secu i y. In o ma ion 2019,10, 122. [C ossRe ] 6. Wick amasinghe, C.S.; Ma ino, D.L.; Ama asinghe, K.; Manic, M. Gene aliza ion o Deep Lea ning o Cybe -Physical Sys em Secu i y: A Su ey. In P oceedings o he IECON 2018—44 h Annual Con e ence o he IEEE Indus ial Elec onics Socie y, Washing on, DC, USA, 21–23 Oc obe 2018; pp. 745–751. 7. Ap uzzese, G.; Colajanni, M.; Fe e i, L.; Guido, A.; Ma che i, M. On he e ec i eness o machine and deep lea ning o cybe secu i y. In P oceedings o he 2018 10 h In e na ional Con e ence on Cybe Con lic (CyCon), Tallinn, Es onia, 30 May–1 June 2018; pp. 371–390. Symme y 2020,12, 410 21 o 24 8. Li, J.H. Cybe secu i y mee s a i icial in elligence: A su ey. F on . In . Technol. Elec on. Eng. 2018 , 19, 1462–1474. [C ossRe ] 9. Xu, Z.; Ray, S.; Sub amanyan, P.; Malik, S. Malwa e de ec ion using machine lea ning based analysis o i ual memo y access pa e ns. In P oceedings o he Con e ence on Design, Au oma ion & Tes in Eu ope, Lausanne, Swi ze land, 27–31 Ma ch 2017; pp. 169–174. 10. Chowdhu y, M.; Rahman, A.; Islam, R. Malwa e analysis and de ec ion using da a mining and machine lea ning classi ica ion. In P oceedings o he In e na ional Con e ence on Applica ions and Techniques in Cybe Secu i y and In elligence, Ningbo, China, 16–18 June 2017; pp. 266–274. 11. Hashemi, H.; Azmoodeh, A.; Hamzeh, A.; Hashemi, S. G aph embedding as a new app oach o unknown malwa e de ec ion. J. Compu . Vi ol. Hacking Tech. 2017,13, 153–166. [C ossRe ] 12. Ye, Y.; Chen, L.; Hou, S.; Ha dy, W.; Li, X. DeepAM: A he e ogeneous deep lea ning amewo k o in elligen malwa e de ec ion. Knowl. In . Sys . 2018,54, 265–285. [C ossRe ] 13. McLaughlin, N.; Ma inez del Rincon, J.; Kang, B.; Ye ima, S.; Mille , P.; Seze , S.; Sa aei, Y.; T ickel, E.; Zhao, Z.; Doupé, A.; e al. Deep and oid malwa e de ec ion. In P oceedings o he Se en h ACM on Con e ence on Da a and Applica ion Secu i y and P i acy, Sco sdale, AZ, USA, 22–24 Ma ch 2017; pp. 301–308. 14. Li, J.; Sun, L.; Yan, Q.; Li, Z.; S isa-an, W.; Ye, H. Signi ican pe mission iden i ica ion o machine-lea ning-based and oid malwa e de ec ion. IEEE T ans. Ind. In o m. 2018 ,14, 3216–3225. [C ossRe ] 15. Zhu, H.J.; You, Z.H.; Zhu, Z.X.; Shi, W.L.; Chen, X.; Cheng, L. D oidDe : E ec i e and obus de ec ion o and oid malwa e using s a ic analysis along wi h o a ion o es model. Neu ocompu ing 2018 ,272, 638–646. [C ossRe ] 16. Ka bab, E.B.; Debbabi, M.; De hab, A.; Mouheb, D. MalDoze : Au oma ic amewo k o and oid malwa e de ec ion using deep lea ning. Digi . In es ig. 2018,24, S48–S59. [C ossRe ] 17. Wang, W.; Zhao, M.; Wang, J. E ec i e and oid malwa e de ec ion wi h a hyb id model based on deep au oencode and con olu ional neu al ne wo k. J. Ambien In ell. Humaniz. Compu . 2019 ,10, 3035–3043. [C ossRe ] 18. Ab Razak, M.F.; Anua , N.B.; O hman, F.; Fi daus, A.; A i i, F.; Salleh, R. Bio-inspi ed o ea u es op imiza ion and malwa e de ec ion. A ab. J. Sci. Eng. 2018,43, 6963–6979. [C ossRe ] 19. Al ahe , A.; Ba ukab, O.M. In elligen Hyb id App oach o And oid Malwa e De ec ion based on Pe missions and API Calls. In . J. Ad . Compu . Sci. Appl. 2017,8, 60–67. [C ossRe ] 20. Bha acha ya, A.; Goswami, R.T.; Mukhe jee, K. A ea u e selec ion echnique based on ough se and imp o ised PSO algo i hm (PSORS-FS) o pe mission based de ec ion o And oid malwa es. In . J. Mach. Lea n. Cybe n. 2019,10, 1893–1907. [C ossRe ] 21. Alejand e, F.V.; Co és, N.C.; Anaya, E.A. Fea u e selec ion o de ec bo ne s using machine lea ning algo i hms. In P oceedings o he 2017 In e na ional Con e ence on Elec onics, Communica ions and Compu e s (CONIELECOMP), Cholula, Mexico, 22–24 Feb ua y 2017; pp. 1–7. 22. Fa ima, A.; Mau ya, R.; Du a, M.K.; Bu ge , R.; Masek, J. And oid Malwa e De ec ion Using Gene ic Algo i hm based Op imized Fea u e Selec ion and Machine Lea ning. In P oceedings o he 2019 42nd In e na ional Con e ence on Telecommunica ions and Signal P ocessing (TSP), Budapes , Hunga y, 1–3 July 2019; pp. 220–223. 23. Al-Yaseen, W.L.; O hman, Z.A.; Naz i, M.Z.A. Mul i-le el hyb id suppo ec o machine and ex eme lea ning machine based on modi ied K-means o in usion de ec ion sys em. Expe Sys . Appl. 2017 , 67, 296–303. [C ossRe ] 24. Kabi , E.; Hu, J.; Wang, H.; Zhuo, G. A no el s a is ical echnique o in usion de ec ion sys ems. Fu u e Gene . Compu . Sys . 2018,79, 303–318. [C ossRe ] 25. Ash aq, R.A.R.; Wang, X.Z.; Huang, J.Z.; Abbas, H.; He, Y.L. Fuzziness based semi-supe ised lea ning app oach o in usion de ec ion sys em. In . Sci. 2017,378, 484–497. [C ossRe ] 26. Shone, N.; Ngoc, T.N.; Phai, V.D.; Shi, Q. A deep lea ning app oach o ne wo k in usion de ec ion. IEEE T ans. Eme g. Top. Compu . In ell. 2018,2, 41–50. [C ossRe ] 27. Hamamo o, A.H.; Ca alho, L.F.; Sampaio, L.D.H.; Ab ão, T.; P oença, M.L., J . Ne wo k anomaly de ec ion sys em using gene ic algo i hm and uzzy logic. Expe Sys . Appl. 2018,92, 390–402. [C ossRe ] Symme y 2020,12, 410 22 o 24 28. Bo es, F.H.; Leenen, L.; De La Ha pe, R. An colony induced decision ees o in usion de ec ion. In P oceedings o he 16 h Eu opean Con e ence on Cybe Wa a e and Secu i y, Dublin, I eland, 29–30 June 2017; pp. 53–62. 29. O e o, F.E.; F ei as, A.A.; Johnson, C.G. Inducing decision ees wi h an an colony op imiza ion algo i hm. Appl. So Compu . 2012,12, 3615–3626. [C ossRe ] 30. Sya i , A.R.; Ga a, W. In usion de ec ion sys em using hyb id bina y PSO and K-nea es neighbo hood algo i hm. In P oceedings o he 2017 11 h In e na ional Con e ence on In o ma ion & Communica ion Technology and Sys em (ICTS), Su abaya, India, 31 Oc obe 2017; pp. 181–186. 31. Ali, M.H.; Al Mohammed, B.A.D.; Ismail, A.; Zolkipli, M.F. A new in usion de ec ion sys em based on as lea ning ne wo k and pa icle swa m op imiza ion. IEEE Access 2018,6, 20255–20261. [C ossRe ] 32. Chen, W.; Liu, T.; Tang, Y.; Xu, D. Mul i-le el adap i e coupled me hod o indus ial con ol ne wo ks sa e y based on machine lea ning. Sa . Sci. 2019,120, 268–275. [C ossRe ] 33. Ga g, S.; Ba a, S. Fuzzi ied cuckoo based clus e ing echnique o ne wo k anomaly de ec ion. Compu . Elec . Eng. 2018,71, 798–817. [C ossRe ] 34. Hajisalem, V.; Babaie, S. A hyb id in usion de ec ion sys em based on ABC-AFS algo i hm o misuse and anomaly de ec ion. Compu . Ne w. 2018,136, 37–50. [C ossRe ] 35. Ga g, S.; Kau , K.; Kuma , N.; Kaddoum, G.; Zomaya, A.Y.; Ranjan, R. A Hyb id Deep Lea ning based Model o Anomaly De ec ion in Cloud Da acen e Ne wo ks. IEEE T ans. Ne w. Se . Manag. 2019. [C ossRe ] 36. Khan, M.A.; Ka im, M.; Kim, Y. A Scalable and Hyb id In usion De ec ion Sys em Based on he Con olu ional-LSTM Ne wo k. Symme y 2019,11, 583. [C ossRe ] 37. Sel akuma , B.; Muneeswa an, K. Fi e ly algo i hm based ea u e selec ion o ne wo k in usion de ec ion. Compu . Secu . 2019,81, 148–155. 38. Gu, T.; Chen, H.; Chang, L.; Li, L. In usion de ec ion sys em based on imp o ed abc algo i hm wi h abu sea ch. IEEJ T ans. Elec . Elec on. Eng. 2019,14. [C ossRe ] 39. Smadi, S.; Aslam, N.; Zhang, L. De ec ion o online phishing email using dynamic e ol ing neu al ne wo k based on ein o cemen lea ning. Decis. Suppo Sys . 2018,107, 88–102. [C ossRe ] 40. Jain, A.K.; Gup a, B.B. Towa ds de ec ion o phishing websi es on clien -side using machine lea ning based app oach. Telecommun. Sys . 2018,68, 687–700. [C ossRe ] 41. Feng, F.; Zhou, Q.; Shen, Z.; Yang, X.; Han, L.; Wang, J. The applica ion o a no el neu al ne wo k in he de ec ion o phishing websi es. J. Ambien . In ell. Humaniz. Compu . 2018, 1–15. [C ossRe ] 42. Sahingoz, O.K.; Bube , E.; Demi , O.; Di i, B. Machine lea ning based phishing de ec ion om URLs. Expe Sys . Appl. 2019,117, 345–357. [C ossRe ] 43. Li, Y.; Yang, Z.; Chen, X.; Yuan, H.; Liu, W. A s acking model using URL and HTML ea u es o phishing webpage de ec ion. Fu u e Gene . Compu . Sys . 2019,94, 27–39. [C ossRe ] 44. Feng, W.; Sun, J.; Zhang, L.; Cao, C.; Yang, Q. A suppo ec o machine based nai e Bayes algo i hm o spam il e ing. In P oceedings o he 2016 IEEE 35 h In e na ional Pe o mance Compu ing and Communica ions Con e ence (IPCCC), Las Vegas, NV, USA, 9–11 Decembe 2016; pp. 1–8. 45. Kuma esan, T.; Palanisamy, C. E-mail spam classi ica ion using S-cuckoo sea ch and suppo ec o machine. In . J. Bio-Inspi ed Compu . 2017,9, 142–156. [C ossRe ] 46. Soh abi, M.K.; Ka imi, F. A ea u e selec ion app oach o de ec spam in he Facebook social ne wo k. A ab. J. Sci. Eng. 2018,43, 949–958. [C ossRe ] 47. Aswani, R.; Ka , A.K.; Ila a asan, P.V. De ec ion o spamme s in wi e ma ke ing: A hyb id app oach using social media analy ics and bio inspi ed compu ing. In . Sys . F on . 2018,20, 515–530. [C ossRe ] 48. Fa is, H.; Ala’M, A.Z.; Heida i, A.A.; Alja ah, I.; Ma a ja, M.; Hassonah, M.A.; Fuji a, H. An in elligen sys em o spam de ec ion and iden i ica ion o he mos ele an ea u es based on e olu iona y andom weigh ne wo ks. In . Fusion 2019,48, 67–83. [C ossRe ] 49. Moon, D.; Im, H.; Kim, I.; Pa k, J.H. DTB-IDS: An in usion de ec ion sys em based on decision ee using beha io analysis o p e en ing APT a acks. J. Supe compu . 2017,73, 2881–2895. [C ossRe ] 50. Sha ma, P.K.; Moon, S.Y.; Moon, D.; Pa k, J.H. DFA-AD: A dis ibu ed amewo k a chi ec u e o he de ec ion o ad anced pe sis en h ea s. Clus . Compu . 2017,20, 597–609. [C ossRe ] 51. Rosenbe g, I.; Sica d, G.; Da id, E.O. DeepAPT: Na ion-s a e APT a ibu ion using end- o-end deep neu al ne wo ks. In P oceedings o he In e na ional Con e ence on A i icial Neu al Ne wo ks, Alghe o, Sa dinia, I aly, 11–14 Sep embe 2017; pp. 91–99. Symme y 2020,12, 410 23 o 24 52. Bu nap, P.; F ench, R.; Tu ne , F.; Jones, K. Malwa e classi ica ion using sel o ganising ea u e maps and machine ac i i y da a. Compu . Secu . 2018,73, 399–410. [C ossRe ] 53. Gha i , I.; Hammoudeh, M.; P enosil, V.; Han, L.; Hega y, R.; Rabie, K.; Apa icio-Na a o, F.J. De ec ion o ad anced pe sis en h ea using machine-lea ning co ela ion analysis. Fu u e Gene . Compu . Sys . 2018 , 89, 349–359. [C ossRe ] 54. Lison, P.; Ma oeidis, V. Au oma ic de ec ion o malwa e-gene a ed domains wi h ecu en neu al models. a Xi 2017, a Xi :1709.07102. 55. Cu in, R.R.; Ga dne , A.B.; G zonkowski, S.; Kleymeno , A.; Mosque a, A. De ec ing DGA domains wi h ecu en neu al ne wo ks and side in o ma ion. a Xi 2018, a Xi :1810.02023. 56. Yu, B.; Pan, J.; Hu, J.; Nascimen o, A.; De Cock, M. Cha ac e le el based de ec ion o DGA domain names. In P oceedings o he IEEE 2018 In e na ional Join Con e ence on Neu al Ne wo ks (IJCNN), Rio de Janei o, B azil, 8–13 July 2018; pp. 1–8. 57. T an, D.; Mac, H.; Tong, V.; T an, H.A.; Nguyen, L.G. A LSTM based amewo k o handling mul iclass imbalance in DGA bo ne de ec ion. Neu ocompu ing 2018,275, 2401–2413. [C ossRe ] 58. Wang, Z.; Dong, H.; Chi, Y.; Zhang, J.; Yang, T.; Liu, Q. DGA and DNS Co e Channel De ec ion Sys em based on Machine Lea ning. In P oceedings o he 3 d In e na ional Con e ence on Compu e Science and Applica ion Enginee ing, Sanya, China, 22–24 Oc obe 2019; p. 156. 59. Yang, L.; Zhai, J.; Liu, W.; Ji, X.; Bai, H.; Liu, G.; Dai, Y. De ec ing Wo d-Based Algo i hmically Gene a ed Domains Using Seman ic Analysis. Symme y 2019,11, 176. [C ossRe ] 60. Thanh, C.T.; Zelinka, I. A Su ey on A i icial In elligence in Malwa e as Nex -Gene a ion Th ea s. Mendel 2019,25, 27–34. [C ossRe ] 61. S oecklin, M.P. DeepLocke : How AI Can Powe a S eal hy New B eed o Malwa e. Secu . In ell. 2018 ,8. A ailable online: h ps://secu i yin elligence.com/deeplocke -how-ai-can-powe -a-s eal hy-new-b eed- o -malwa e/ (accessed on 8 Feb ua y 2020). 62. Rigaki, M.; Ga cia, S. B inging a gan o a kni e- igh : Adap ing malwa e communica ion o a oid de ec ion. In P oceedings o he 2018 IEEE Secu i y and P i acy Wo kshops (SPW), San F ancisco, CA, USA, 24 May 2018; pp. 70–75. 63. Ney, P.; Kosche , K.; O ganick, L.; Ceze, L.; Kohno, T. Compu e Secu i y, P i acy, and DNA Sequencing: Comp omising Compu e s wi h Syn hesized DNA, P i acy Leaks, and Mo e. In P oceedings o he 26 h USENIX Secu i y Symposium (USENIX Secu i y 17), Vancou e , BC, Canada, 16–18 Augus 2017; pp. 765–779. 64. Zelinka, I.; Das, S.; Siko a, L.; Šenkeˇ ík, R. Swa m i us-Nex -gene a ion i us and an i i us pa adigm? Swa m E ol. Compu . 2018,43, 207–224. [C ossRe ] 65. T uong, T.C.; Zelinka, I.; Senke ik, R. Neu al Swa m Vi us. In Swa m, E olu iona y, and Meme ic Compu ing and Fuzzy and Neu al Compu ing; Sp inge : Be lin, Ge many, 2019; pp. 122–134. 66. Seymou , J.; Tully, P. Weaponizing da a science o social enginee ing: Au oma ed E2E spea phishing on Twi e . Black Ha USA 2016,37.# =00:17,00:54. [C ossRe ] 67. Seymou , J.; Tully, P. Gene a i e Models o Spea Phishing Pos s on Social Media. a Xi 2018 , a Xi :1802.05196. 68. G osse, K.; Pape no , N.; Manoha an, P.; Backes, M.; McDaniel, P. Ad e sa ial examples o malwa e de ec ion. In P oceedings o he Eu opean Symposium on Resea ch in Compu e Secu i y, Oslo, No way, 11–15 Sep embe 2017; pp. 62–79. 69. Yang, W.; Kong, D.; Xie, T.; Gun e , C.A. Malwa e de ec ion in ad e sa ial se ings: Exploi ing ea u e e olu ions and con usions in and oid apps. In P oceedings o he 33 d Annual Compu e Secu i y Applica ions Con e ence, O lando, FL, USA, 4–8 Decembe 2017; pp. 288–302. 70. Hu, W.; Tan, Y. Gene a ing ad e sa ial malwa e examples o black-box a acks based on GAN. a Xi 2017 , a Xi :1702.05983. 71. Ande son, H.S.; Woodb idge, J.; Fila , B. DeepDGA: Ad e sa ially- uned domain gene a ion and de ec ion. In P oceedings o he 2016 ACM Wo kshop on A i icial In elligence and Secu i y, Vienna, Aus ia, 28 Oc obe 2016; pp. 13–21. 72. Kolosnjaji, B.; Demon is, A.; Biggio, B.; Maio ca, D.; Giacin o, G.; Ecke , C.; Roli, F. Ad e sa ial malwa e bina ies: E ading deep lea ning o malwa e de ec ion in execu ables. In P oceedings o he 2018 26 h Eu opean Signal P ocessing Con e ence (EUSIPCO), Rome, I aly, 3–7 Sep embe 2018; pp. 533–537. Symme y 2020,12, 410 24 o 24 73. Ande son, H.S.; Kha ka , A.; Fila , B.; E ans, D.; Ro h, P. Lea ning o e ade s a ic PE machine lea ning malwa e models ia ein o cemen lea ning. a Xi 2018, a Xi :1801.08917. 74. Li, P.; Liu, Q.; Zhao, W.; Wang, D.; Wang, S. BEBP: An poisoning me hod agains machine lea ning based idss. a Xi 2018, a Xi :1803.03965. 75. Chen, S.; Xue, M.; Fan, L.; Hao, S.; Xu, L.; Zhu, H.; Li, B. Au oma ed poisoning a acks and de enses in malwa e de ec ion sys ems: An ad e sa ial machine lea ning app oach. Compu . Secu . 2018 ,73, 326–344. [C ossRe ] 76. T amè , F.; Zhang, F.; Juels, A.; Rei e , M.K.; Ris enpa , T. S ealing machine lea ning models ia p edic ion apis. In P oceedings o he 25 h USENIX Secu i y Symposium (USENIX Secu i y 16), Aus in, TX, USA, 10–12 Augus 2016; pp. 601–618. 77. Ca lini, N.; Liu, C.; E lingsson, Ú.; Kos, J.; Song, D. The sec e sha e : E alua ing and es ing unin ended memo iza ion in neu al ne wo ks. In P oceedings o he 28 h USENIX Secu i y Symposium (USENIX Secu i y 19), San Diego, Cali o nia, CA, USA, 14–16 Augus 2019; pp. 267–284. 78. Resende, J.S.; Ma ins, R.; An unes, L. A Su ey on Using Kolmogo o Complexi y in Cybe secu i y. En opy 2019,21, 1196. [C ossRe ] c 2020 by he au ho s. Licensee MDPI, Basel, Swi ze land. This a icle is an open access a icle dis ibu ed unde he e ms and condi ions o he C ea i e Commons A ibu ion (CC BY) license (h p://c ea i ecommons.o g/licenses/by/4.0/).