symme y
S
S
A icle
A i icial In elligence in he Cybe Domain:
O ense and De ense
Thanh Cong T uong 1,2,*,† , Quoc Bao Diep 1,† and I an Zelinka 1,3,†
1Facul y o Elec ical Enginee ing and Compu e Science, VSB-Technical Uni e si y o Os a a,
17. lis opadu 2172/15, Os a a-Po uba, 708 00 Os a a, Czech Republic; [email p o ec ed] (Q.B.D.);
[email p o ec ed] o [email p o ec ed] (I.Z.)
2Facul y o In o ma ion Technology, Uni e si y o Finance-Ma ke ing, Ho Chi Minh Ci y, Vie nam
3
Modeling E olu iona y Algo i hms Simula ion and A i icial In elligence, Facul y o Elec ical & Elec onics
Enginee ing, Ton Duc Thang Uni e si y, Ho Chi Minh Ci y, Vie nam
*Co espondence: [email p o ec ed] o [email p o ec ed]; Tel.: +420-774-820-835
† These au ho s con ibu ed equally o his wo k.
Recei ed: 30 Decembe 2019; Accep ed: 8 Feb ua y 2020; Published: 4 Ma ch 2020


Abs ac :
A i icial in elligence echniques ha e g own apidly in ecen yea s, and hei applica ions
in p ac ice can be seen in many ields, anging om acial ecogni ion o image analysis.
In he cybe secu i y domain, AI-based echniques can p o ide be e cybe de ense ools and help
ad e sa ies imp o e me hods o a ack. Howe e , malicious ac o s a e awa e o he new p ospec s oo
and will p obably a emp o use hem o ne a ious pu poses. This su ey pape aims a p o iding
an o e iew o how a i icial in elligence can be used in he con ex o cybe secu i y in bo h o ense
and de ense.
Keywo ds:
cybe secu i y; a i icial in elligence; machine lea ning; deep lea ning; bio-inspi ed
compu ing; sys ems secu i y
1. In oduc ion
Cybe secu i y in ol es he de ising o de ense s a egies ha p ese e compu ing esou ces,
ne wo ks, p og ams, and da a om unau ho ized access, change, o des uc ion. Due o he d ama ic
ad ances in in o ma ion and communica ion echnologies, new cybe secu i y h ea s a e eme ging
and changing apidly. Cybe c iminals a e adop ing new and sophis ica ed echniques ha inc ease he
speed and scale o hei a acks. Hence, he e is a equi emen o mo e lexible, adap able, and obus
cybe de ense sys ems ha a e capable o de ec ing a wide a ie y o h ea s in eal- ime. In ecen
yea s, he adop ion o a i icial in elligence (AI) echniques has been ising and main aining a c ucial
ole in cybe h ea de ec ion and p e en ion.
While he concep o AI was p oposed in he 1950s, in ecen yea s, i has g own a a signi ican
pace and is now in luencing all aspec s o communi ies and occupa ions. Many a eas bene i om
AI, such as gaming, na u al language p ocessing, heal h ca e, manu ac u ing, educa ion, and o he s.
This end is also a ec ing he cybe secu i y ield whe e AI has been u ilized o bo h a acking
and de ending in he cybe space. On he o ense side, cybe h ea s can employ AI o imp o e he
sophis ica ion and scope o hei a acks. On he de ense side, AI is u ilized o enhance he de ense
s a egies, so ha he de ense sys ems become mo e obus , lexible, and e icien , which in ol es
being adap i e wi h changes in he en i onmen o dec ease he impac s occu ed.
Recen ly, esea che s p esen ed se e al su eys in he domain o AI and cybe secu i y. Howe e ,
some o hem jus ocused on he adop ing machine lea ning me hods o cybe p oblems such as
hose in [
1
–
4
]. O he esea ch [
5
,
6
] jus ocused on deep lea ning me hods. Addi ionally, he e is a lack
o li e a u e dealing wi h he ne a ious use o AI.
Symme y 2020,12, 410; doi:10.3390/sym12030410 www.mdpi.com/jou nal/symme y
Symme y 2020,12, 410 2 o 24
Ap uzzese e al. [
7
] pe o med a su ey on ML and DL me hods o cybe secu i y. Ne e heless,
hei esea ch was jus co e ing a acks ela ed pa icula ly o ne wo k in usion de ec ion, malwa e
in es iga ion, and spam iden i ica ion.
The au ho in [
8
] discussed he in e sec ion o AI and cybe secu i y. Mo e pa icula ly, he
pape e iewed some ML and DL app oaches o coun e agains cybe a acks. Wha is mo e, he
au ho in oduced he possibili y o a acking he AI model. Ne e heless, he pape jus discussed
ad e sa ial a acks and igno ed o he kinds o a ack using he AI model, such as poisoning da a, and
he ex ac ion model.
Ano he app oach by he au ho s in [
4
] poin ed ou he di e ences be ween adi ional ML and
DL me hods o cybe secu i y. Howe e , hei su ey jus concen a ed on in usion de ec ion.
Based on he abo e ci cums ances, his su ey pape pu sues a wo- old goal. The i s is o ca y
ou an explo a ion o he impac o AI in cybe secu i y. The second is o eplenish he li e a u e wi h
ecen e iews on cybe applica ions o AI me hods.
The main con ibu ions o his su ey a e lis ed as ollows:
•
To p esen he impac o AI echniques on cybe secu i y: we p o ide a b ie o e iew o AI and
discuss he impac o AI in he cybe domain.
•
Applica ions o AI o cybe secu i y: we conduc a su ey o he applica ions o AI o
cybe secu i y, which co e s a wide- ange cybe a ack ypes.
•
Discussion on he po en ial secu i y h ea s om ad e sa ial uses o AI echnologies: we
in es iga e a ious po en ial h ea s and a acks may a ise h ough he use o AI sys ems.
•
Challenges and u u e di ec ions: We discuss he po en ial esea ch challenges and open esea ch
di ec ions o AI in cybe secu i y.
The emainde o his pape p oceeds as ollows. Sec ion 2desc ibes he esea ch me hodology.
Sec ion 3p esen s a b ie o e iew o AI and discusses he ole o AI in cybe secu i y. Sec ion 4gi es
a b ie o e iew o AI me hodology o cybe secu i y. Sec ion 5 ocuses on cybe applica ions o AI
me hods. Sec ion 6discusses a ious po en ial h ea s ha adop AI echniques. Challenges and open
esea ch di ec ions a e discussed in Sec ion 7. Sec ion 8p o ides sho discussions abou he ole o AI,
and compa es ou wo k wi h exis ing su eys. Sec ion 9concludes he pape .
2. Resea ch Me hodology
To ge a comp ehensi e o e iew o he junc ion be ween AI and cybe secu i y, we used ou
da abases: Web o Science, Scopus, IEEE Xplo e, and ACM digi al lib a y. Alongside ha , he Google
Schola sea ch engine was also u ilized. A se o keywo ds ela ed o he opic ha e been used in
hese da abases. To enhance he sea ch esul s, he au ho s e ined di e en keywo ds and keywo d
mix u es o each sea ch engine o ob ain he highes co e age.
In a second s ep, we used a il e based on he ob ained esul s. The sea ch esul s we e limi ed only
o he exis ing pape s published in he las ou yea s, because he pu pose o his pape is o disco e
he mos ecen esea ch ends o AI in cybe secu i y. Nex , he esul s we e so ed by he numbe o
ci a ions, and manusc ip s ha had mo e han i e ci a ions we e selec ed. On he o he hand, ecen ly
published pape s which had less han i e ci a ions bu had no el app oaches we e also chosen. A e
ha , he ma e ials which me he ollowing c i e ia we e excluded:
•Pape s which had i les belonging o subjec s ou side he scope o his esea ch.
•Books, pa en documen s, echnical epo s, ci a ions.
•Pape s which we e no w i en in English.
In he hi d s ep, we examined he abs ac s and he conclusions o ele an da a. Th ough his
s ep, he au ho s con i med whe he he classi ied pape s ma ched he main opic o he junc ion
be ween AI and cybe secu i y. Consequen ly, hose pape s which we e he mos ele an o he ask
we e chosen.
Symme y 2020,12, 410 3 o 24
3. The impac o AI on Cybe secu i y
De ining AI can ake wo app oaches. Fi s , i is a science ha s i es o disco e he na u e o
in elligence and de elop sma machines in which scien is s apply in o ma ion, logic, sel -lea ning, and
de e mina ion o make machines become in elligen . To pu i simply, humans c ea e machines wi h
in elligence. This in elligence can hink, lea n, decide, and wo k while ying o sol e a p oblem, as a
human in ellec does. On he o he hand, scien is s de ine AI as a science ha esea ches and de elops
me hods o esol ing complexi y p oblems ha a e impossible o be esol ed wi hou adop ing
in elligence. Fo example, scien is s can build an AI sys em o eal- ime analysis and decision making
based on eno mous amoun s o da a. In ecen yea s, AI has esul ed in ad ances in many scien i ic
and echnological ields, such as compu e ized obo s, image ecogni ion, na u al language p ocesses,
expe sys ems, and o he s.
The apid de elopmen o compu ing echnology and he in e ne has a signi ican impac on
people’s daily li es and wo k. Un o una ely, i also caused many new cybe secu i y challenging
issues: Fi s , he explosion o da a makes manual analysis imp ac ical. Second, h ea s a e g owing
a a high a e, which also means ha new, sho -li ed species and highly adap i e h ea s become
commonplace. Thi d, a p esen , he h ea s comp omise a ious echniques o p opaga ion, in ec ion,
and e asion; he e o e, hey a e ha d o de ec and p edic . Mo eo e , he expense o p e en h ea s
also should be conside ed. I akes a lo o ime, money, and e o o gene a e and implemen an
algo i hm. Addi ionally, employing o aining specialis s in he ield is ha d and expensi e. Wha is
mo e, many h ea a ia ions eme ge and sp ead con inuously. Hence, AI-based me hods a e expec ed
o cope wi h hese cybe secu i y issues.
3.1. The Posi i e Uses o AI
In he ield o cybe secu i y, AI is al eady being used o ad ance de ensi e capabili ies. Based on
i s powe ul au oma ion and da a analysis capabili ies, AI can be used o analyze la ge amoun s o
da a wi h e iciency, accu acy, and speed. An AI sys em can ake ad an age o wha i knows and
unde s and he pas h ea s o iden i y simila a acks in he u u e, e en i hei pa e ns change.
Undoub edly, a i icial in elligence has se e al ad an ages when i comes o cybe secu i y in he
ollowing aspec s:
•
AI can disco e new and sophis ica ed changes in a ack lexibili y: Con en ional echnology is
ocused on he pas and elies hea ily on known a acke s and a acks, lea ing oom o blind
spo s when de ec ing unusual e en s in new a acks. The limi a ions o old de ense echnology
a e now being add essed h ough in elligen echnology. Fo example, p i ileged ac i i y in
an in ane can be moni o ed, and any signi ican mu a ion in p i ileged access ope a ions can
deno e a po en ial in e nal h ea . I he de ec ion is success ul, he machine will ein o ce he
alidi y o he ac ions and become mo e sensi i e o de ec ing simila pa e ns in he u u e. Wi h
a la ge amoun o da a and mo e examples, he machine can lea n and adap be e o de ec
anomalous, as e , and mo e accu a e ope a ions. This is especially use ul while cybe -a acks a e
becoming mo e sophis ica ed, and hacke s a e making new and inno a i e app oaches.
•
AI can handle he olume o da a: AI can enhance ne wo k secu i y by de eloping au onomous
secu i y sys ems o de ec a acks and espond o b eaches. The olume o secu i y ale s
ha appea daily can be e y o e whelming o secu i y g oups. Au oma ically de ec ing and
esponding o h ea s has helped o educe he wo k o ne wo k secu i y expe s and can assis in
de ec ing h ea s mo e e ec i ely han o he me hods. When a la ge amoun o secu i y da a is
c ea ed and ansmi ed o e he ne wo k e e y day, ne wo k secu i y expe s will g adually ha e
di icul y acking and iden i ying a ack ac o s quickly and eliably. This is whe e AI can help, by
expanding he moni o ing and de ec ion o suspicious ac i i ies. This can help ne wo k secu i y
pe sonnel eac o si ua ions ha hey ha e no encoun e ed be o e, eplacing he ime-consuming
analysis o people.
Symme y 2020,12, 410 4 o 24
•
An AI secu i y sys em can lea n o e ime o espond be e o h ea s: AI helps de ec h ea s
based on applica ion beha io and a whole ne wo k’s ac i i y. O e ime, AI secu i y sys em
lea ns abou he egula ne wo k o a ic and beha io , and makes a baseline o wha is no mal.
F om he e, any de ia ions om he no m can be spo ed o de ec a acks.
AI echniques seem an up-and-coming a ea o esea ch ha enhances he secu i y measu es
o cybe space. Many AI me hods a e being used o deal wi h h ea s, including compu a ional
in elligence, neu al ne wo ks, in elligen agen s, a i icial immune sys ems, da a mining, pa e n
ecogni ion, heu is ics, ML, DL, and o he s. Howe e , among hese echniques, ML and DL a ac ed a
lo o a en ion ecen ly and ob ained he mos achie emen s in comba ing agains cybe - h ea s.
3.2. D awbacks and Limi a ions o Using AI
The ad an ages highligh ed abo e a e jus a ac ion o he po en ial o how AI can assis
cybe secu i y, bu he applica ion o his echnology has some limi a ions, as desc ibed below.
•
Da a se s: C ea ing an AI sys em demands a conside able numbe o inpu samples, and ob aining
and p ocessing he samples can ake a long ime and a lo o esou ces.
•
Resou ce equi emen s: Building and main aining he undamen al sys em needs an immense
amoun o esou ces, including memo y, da a, and compu ing powe . Wha is mo e, skilled
esou ces necessa y o implemen his echnology equi e a signi ican cos .
•
False ala ms: F equen alse ala ms a e an issue o end-use s, dis up ing business by po en ially
delaying any necessa y esponse and gene ally a ec ing e iciency. The p ocess o ine- uning is a
ade-o be ween educing alse ala ms and main aining he secu i y le el.
•
A acks on he AI-based sys em: A acke s can use a ious a ack echniques ha a ge AI
sys ems, such as ad e sa ial inpu s, da a poisoning, and model s ealing.
One impo an aspec o be aken in o accoun is he ne a ious use o AI. This echnology will also
be used as a way o imp o e h ea s. Fo example, malicious ac o s can le e age he ML echnique o
gene a e a ha d- o-de ec malwa e a ian wi h machine speed. Wha is mo e, AI migh be able o
pe sonalize he phishing scheme be e and aise he scale o he a ack, making he a ack mo e likely
o succeed. Mo e de ail abou his ma e discussed in Sec ion 6.
4. AI Me hodology o Cybe secu i y
In his sec ion, he au ho s gi e an o e iew o he lea ning algo i hms, an essen ial concep o AI.
Fu he mo e, we p esen a b ie in oduc ion abou ML, DL, and bio-inspi ed compu a ion me hods
ha a e equen ly u ilized in he a ea o cybe secu i y.
4.1. Lea ning Algo i hms
AI is a b anch o compu e science ha seeks o p oduce a new ype o in elligen au oma on
ha esponds like human in elligence. To achie e his goal, machines need o lea n. To be mo e
p ecise, we need o ain he compu e by using he lea ning algo i hms. Gene ally, lea ning algo i hms
help o enhance pe o mance in accomplishing a ask h ough lea ning and aining om expe ience.
The e a e cu en ly h ee majo ypes o lea ning algo i hms which we use o ain machines:
•
Supe ised lea ning: This ype equi es a aining p ocess wi h a la ge and ep esen a i e se
o da a ha has been p e iously labeled. These lea ning algo i hms a e equen ly used as a
classi ica ion mechanism o a eg ession mechanism.
•
Unsupe ised lea ning: In con as o supe ised lea ning, unsupe ised lea ning algo i hms
use unlabeled aining da ase s. These app oaches a e o en used o clus e da a, educe
dimensionali y, o es ima e densi y.
•
Rein o cemen lea ning: Rein o cemen lea ning is a ype o lea ning algo i hm ha lea ns he
bes ac ions based on ewa ds o punishmen . Rein o cemen lea ning is use ul o si ua ions
whe e da a is limi ed o no gi en.
Symme y 2020,12, 410 5 o 24
4.2. Machine Lea ning Me hods
Machine lea ning (ML) is a b anch o AI ha aims o empowe sys ems by u ilizing da a o lea n
and imp o e wi hou being explici ly p og ammed. ML has s ong ies o ma hema ical echniques
ha enable a p ocess o ex ac ing in o ma ion, disco e ing pa e ns, and d awing conclusions om
da a. The e a e di e en ypes o he ML algo i hm, bu hey can gene ally be classi ied in o h ee main
ca ego ies: supe ised lea ning, unsupe ised lea ning, and ein o cemen lea ning. In he compu e
secu i y domain, he s anda d ML algo i hms a e decision ees (DT), suppo ec o machines (SVM),
Bayesian algo i hms, k-nea es neighbo (KNN), andom o es (RF), associa ion ule (AR) algo i hms,
ensemble lea ning (EL), k-means clus e ing, and p incipal componen analysis (PCA).
4.3. Deep Lea ning Me hods
Deep lea ning (DL) is a sub- ield o ML, and i uses da a o each compu e s how o do hings
only humans a e capable o a ha ime. I s mo i a ion lies in he wo king mechanisms o he human
b ain and neu ons o p ocessing signals. The co e o deep lea ning is ha i we cons uc mo e
ex ensi e neu al ne wo ks and ain hem wi h as much da a as possible, hei pe o mance con inues
o inc ease. The mos impo an ad an age o DL o e he con en ional ML is i s supe io pe o mance
in la ge da ase s. Simila ly o ML me hods, DL me hods also ha e supe ised lea ning, unsupe ised
lea ning, and ein o cemen lea ning. The bene i o DL is he le e age o unsupe ised lea ning o
selec ea u e au oma ically. The ypical DL algo i hms equen ly u ilized in he cybe secu i y domain
a e: eed o wa d neu al ne wo ks (FNN), con olu ional neu al ne wo ks (CNNs), ecu en neu al
ne wo ks (RNN), deep belie ne wo ks (DBNs), s acked au oencode s (SAE), gene a i e ad e sa ial
ne wo ks (GANs), es ic ed Bol zmann machines (RBMs), and ensemble o DL ne wo ks (EDLNs).
4.4. Bio-Inspi ed Compu a ion Me hods
Bio-inspi ed compu a ion is a b anch o AI which eme ged as one o he mos s udied
du ing ecen yea s. I is a collec ion o in elligen algo i hms and me hods ha adop bio-inspi ed
beha io s and cha ac e is ics o sol e a wide ange o complex academic and eal domain p oblems.
Among many biological-inspi ed me hods, he ollowing echniques a e mos commonly used in he
cybe secu i y domain: gene ic algo i hms (GA), e olu ion s a egies (ES), an colony op imiza ion
(ACO), pa icle swa m op imiza ion (PSO), and a i icial immune sys ems (AIS).
5. AI-Based App oaches o De ending Agains Cybe space A acks
Recen ly, scien is s p oposed nume ous echniques ha ha e u ilized AI me hods o de ec
o ca ego ize malwa e, de ec ne wo k in usions, phishing, and spam a acks; coun e Ad anced
pe sis en h ea (APT); and iden i y domain gene a ed by doamain gene a ion algo i hms (DGAs).
In his sec ion, we ca ego y hese li e a u e in o ou main g oups: malwa e iden i ica ion; ne wo k
in usion de ec ion; phishing and SPAM iden i ica ion; and o he , which comp omises coun e ing APT
and iden i ying DGAs. Figu e 1illus a es he p ima y a eas o u ilizing AI o cybe secu i y.

Symme y 2020,12, 410 6 o 24
Cybe Applica ions o
AI-base me hods
Malwa e de ec ion
Ne wo k in usion
Phishing/Spam de ec ion
PC malwa e
And oid malwa e
O he
In usion de ec ion
Anomaly de ec ion
Web phishing de ec ion
Mail phishing de ec ion
Spam mail
Spam on social ne wo ks
Coun e ing APTs
Iden i y domain names
gene a ed by DGAs
Figu e 1. Main b anches o cybe secu i y applica ions adop ing AI echniques.
5.1. Malwa e Iden i ica ion
Malwa e is a gene al e m o many ypes o malicious so wa e, such as i uses, wo ms,
ojan ho ses, exploi s, bo ne , e o i uses, and oday, malwa e is a popula me hod o cybe -a ack.
Malwa e’s impac on digi al socie y is eno mous, so a conside able amoun o esea ch abou adop ing
AI echniques has been done o p e en and mi iga e malwa e. The mos ecen and no ewo hy
con ibu ions u ilize in elligence o malwa e de ec ion and p e en ion—desc ibed as ollows.
In [
9
], he au ho s adop ed ML o c ea e an online amewo k o ha dwa e-assis ed malwa e
de ec ion based on i ual memo y access pa e ns. The p oposed me hod used logis ic eg ession,
a suppo ec o machine, and a andom o es classi ie , and pe o med on he RIPE benchma k
sui e o he expe imen s. The au ho s epo ed ha he amewo k has a ue posi i e a e o 99%
wi h a less han 5% alse posi i e a e. Meanwhile, he schola s in [
10
] p esen ed a amewo k o
classi ying and de ec ing malicious so wa e using da a mining and ML classi ica ion. In ha wo k,
bo h signa u e-based and anomaly-based ea u es we e analyzed o de ec ion. Expe imen al esul s
showed ha he p oposed me hod ou pe o med o he simila me hods.
Ano he app oach [
11
] used ope a ional codes (OpCode), k-nea es neighbo s (KNN), and a
suppo ec o machine (SVM) as ML classi ie s o classi y malwa e. The OpCode was ep esen ed as
a g aph and embedded in o eigenspace; hen, one classi ie o an ensemble o classi ie s we e u ilized
o classi y each ec o as malwa e o benign. The empi ical esul showed ha he p oposed model is
e icien wi h a low alse ala m a e and high de ec ion a e.
La e , Ye e al. [
12
] buil a deep lea ning a chi ec u e o in elligen malwa e de ec ion. In his
wo k, hey u ilized an Au oEncode s acked up wi h mul ilaye es ic ed Bol zmann machines (RBMs)
Symme y 2020,12, 410 7 o 24
o de ec unknown malwa e. The au ho claimed ha he e ogeneous deep lea ning amewo k could
imp o e he o e all pe o mance in malwa e de ec ion compa ed wi h adi ional shallow lea ning
me hods and deep lea ning me hods.
A ecen end o esea ch in malwa e de ec ion ocused on mobile malwa e in gene al and
And oid malwa e in pa icula . Machine lea ning, along wi h deep lea ning, was a signi ican
b eak h ough in his a ea. In [
13
], a deep con olu ional neu al ne wo k (CNN) was adop ed o
iden i y malwa e. The aw opcode sequence om a disassembled p og am was used o classi y
malwa e. The au ho s in [
14
] u ilized a suppo ec o machine (SVM) and he mos signi ican
pe missions om all o he pe mission da a o dis inguish be ween benign and malicious apps. In [
15
],
he au ho s p esen ed no el ML algo i hms, namely, o a ion o es , o malwa e iden i y. An a i icial
neu al ne wo k (ANN) and he aw sequences o API me hod calls we e u ilized in [
16
] o de ec
And oid malwa e. A ecen s udy by Wang e al. [
17
] in oduced a hyb id model based on deep
au oencode (DAE) and a con olu ional neu al ne wo k (CNN) o aise he accu acy and e iciency o
la ge-scale And oid malwa e de ec ion.
Ano he esea ch di ec ion ha a ac ed he a en ion o scien is s was he use o bio-inspi ed
me hods o malwa e classi ica ion. These echniques we e mainly used o ea u e op imiza ion and
op imizing he pa ame e o he classi ie s. Fo example, pa icle swa m op imiza ion (PSO) was
adop ed in [
18
–
20
]; he gene ic algo i hm (GA) was u ilized in [
21
,
22
] o enhance he e ec i eness o a
malwa e de ec ion sys em.
Table 1abs ac s some cha ac e is ics o he discussed malwa e iden i ica ion app oaches,
conce ning he ocus a eas, echniques, ea u es, da ase s, and alida ion me ics used o e alua e he
models’ pe o mances. Fo he alida ion me ics, we p esen he bes pe o ming me hod in he pape .
Fo he mul i- ask model, we p esen he e alua ion measu es o all asks, i hey exis , gi en by he
"/" symbol. The ac onyms o his able a e desc ibed in Table 2.
Table 1. Selec ed li e a u e o AI-based app oaches in malwa e in es iga ion.
Re e ences Yea Focus Tech. Fea u es Da ase Valida ion
Me ics
[9] 2017 PC
malwa e
SVM,RF
Logis ic eg ession
MAP’s
ea u e se s RIPE DR: 99%
FPR: 5%
[10] 2017 PC
malwa e BAM, MLP
N-g am,
Windows
API calls
Sel collec ion:
52,185 samples
ACC: 98.6%
FPR: 2%
[11] 2017 PC
malwa e KNN, SVM OpCode
g aph
Sel collec ion:
22,200 samples ACC, FPR
[13] 2017 And oid
malwa e CNN Opcode
sequence
GNOME,
McA ee Labs
ACC: 98%/80%/87%,
F-sco e: 97%/78%/86%
[19] 2017 And oid
malwa e
ANF,
PSO
Pe missions,
API Calls
Sel collec ion:
500 samples ACC: 89%
[21] 2017 Bo ne C4.5, GA Mul i ea u es ISOT , ISCX DR: 99.46%/95.58%
FPR: 0.57%/ 2.24%
[12] 2018 PC
malwa e
Au oEncode ,
RBM
Windows API
calls
Sel collec ion:
20,000 samples ACC: 98.2%
[14] 2018 And oid
malwa e SVM, DT Signi ican
pe missions
Sel collec ion:
54,694 samples
ACC: 93.67%
FPR: 4.85%
[15] 2018 And oid
malwa e Ro a ion Fo es
Pe missions,
APIs,
sys em e en s
Sel collec ion:
2,030 smaples ACC: 88.26%
[16] 2018 And oid
malwa e ANN API call
Malgenome,
D ebin,
Maldoze
F1-Sco e: 96.33%
FPR: 3.19%
[18] 2018 And oid
malwa e
PSO, RF, J48,
KNN, MLP, AdaBoos Pe missions Sel collec ion:
8500 samples
TPR: 95.6%
FPR: 0.32%
Symme y 2020,12, 410 8 o 24
Table 1. Con .
Re e ences Yea Focus Tech. Fea u es Da ase Valida ion
Me ics
[17] 2019 And oid
malwa e DAE, CNN
Pe missions,
il e ed in en s,
API calls,
ha dwa e ea u es,
code ela ed pa e ns
Sel collec ion:
23000 samples
ACC: 98.5%/98.6%
FPR: 1.67%/1.82%
[20] 2019 And oid
malwa e
PSO, Bayesne ,
Naï e Bayes, SMO,
DT, RT, RF
J48, MLP
Pe missions
UCI, KEEL,
Con agiodump,
Wang’s eposi o y
ACC:
79.4%/47.6%/
82.9%/94.1%/
100%/77.9%
[22] 2019 And oid
malwa e SVM, ANN App Componen s,
Pe missions
Sel collec ion:
44,000 samples ACC: 95.2%/96.6%
Table 2. The ac onyms used in Table 1.
ACC: Accu acy
FPR: False posi i e a e
DR: De ec ion a e
RF: Random o es
SVM: Suppo ec o machine
MLP: mul ilaye pe cep on
BAM: bina y associa i e memo y
KNN: k-nea es neighbo s
CNN: Con olu ional neu al ne wo k
ANF: Adap i e neu al uzzy
GA: Gene ic Algo i hm
RBMs: Res ic ed Bol zmann machines
DT: Decision ee
GP: Gene ic p og amming
DT: decision ee
DAE: Deep au o-encode
5.2. In usion De ec ion
An in usion de ec ion sys em (IDS) is a sys em ha is supposed o p o ec he sys em om
possible inciden s, iola ions, o imminen h ea s. AI-based echniques a e app op ia e o de eloping
IDS, and ou pe o m o he echniques because o hei lexibili y, adap abili y, apid calcula ions, and
quick lea ning. Hence, many esea che s s udied in elligen me hods o imp o e he pe o mance o
IDS. The ocus was on de eloping op imized ea u es and imp o ing he classi ie s o educe he alse
ala ms. Some ecen no able s udies a e lis ed as ollows.
Al-Yaseen e al. [
23
] combined a suppo ec o machine (SVM) and an ex eme lea ning machine
wi h modi ied k-means as a model o IDS. Using he KDD’99 Cup da ase , hei model a chi ed
a esul o up o 95.75% accu acy and 1.87% alse ala ms. Meanwhile, Kabi e al. [
24
] in oduced
a me hod o an in usion de ec ion sys em based on sampling wi h a leas squa e suppo ec o
machine (LS-SVM). The p oposed me hodology was alida ed h ough he KDD’99 Cup da ase and
ob ained a ealis ic pe o mance in e ms o accu acy and e iciency.
The au ho s in [
25
] in oduced a uzziness based semi-supe ised lea ning app oach o IDS.
In hei wo k, hey u ilized unlabeled samples assis ed wi h a supe ised lea ning algo i hm o
enhance he pe o mance o he classi ie . The algo i hm was es ed on he KDD’99 Cup da ase and
ou pe o med o he compa a i e algo i hms.
La e , Shone e al. [
26
] p oposed a no el deep lea ning-based in usion de ec ion me hod called
nonsymme ic deep au oencode (NDAE). The au ho s used Tenso Flow and e alua ed hei me hod by
using KDD Cup ’99 and NSL-KDD da ase s. They ha e claimed ha hei model achie ed an accu acy
o 97.85%.
Ano he app oach using gene ic algo i hms (GA) and uzzy logic o ne wo k in usion de ec ion
is p esen ed by Hamamo o e al. [
27
]. The GA is used o c ea e a digi al signa u e o a ne wo k segmen
using glow analysis (DSNSF), a p edic ion o he ne wo k’s a ic beha io o a gi en ime in e al.
Addi ionally, he uzzy logic app oach is adop ed o assess whe he an ins ance ep esen s an anomaly
o no . The e alua ion was conduc ed by using eal ne wo k a ic om a uni e si y and ob ained an
accu acy o 96.53% and a alse ala m o 0.56%.
One poin o be aken in o accoun is ha he use o swa m in elligence (SI) o IDS.
Bo es e al. [28]
p esen ed a new me hod, namely, an ee mine (ATM) classi ica ion, which is a decision ee
Symme y 2020,12, 410 9 o 24
using ACO ins ead o con en ional echniques, such as C4.5 and CART [
29
], o in usion de ec ion.
Using NSL-KDD da ase s, hei app oach achie ed he accu acy o 65% and a alse ala m a e p 0%.
In a la e s udy [
30
], he au ho s p esen ed an IDS using bina y PSO and KNN. The p oposed
me hod consis s o ea u e selec ion and classi ica ion s eps. Based on he esul s ob ained, he
algo i hm showed excellen pe o mance, and he p oposed hyb id algo i hm aised he accu acy
gene a ed by KNN by up o 2%. Meanwhile, Ali e al. [
31
] in oduced a lea ning model o a as
lea ning ne wo k (FLN) based on PSO named PSO-FLN, and hen he model was u ilized o he
p oblem o IDS. The PSO-FLN model was es ed on he KDD’99 Cup da ase s and achie ed he highes
es ing accu acy compa ed o o he me a-heu is ic algo i hms.
In he ecen s udy by Chen e al. [
32
], a mul i-le el adap i e coupled in usion de ec ion me hod
combining whi e lis echnology and machine lea ning was p esen ed. The whi e lis was used o il e
he communica ion, and he machine lea ning model was used o iden i y abno mal communica ion.
In his a icle, he adap i e PSO algo i hm and he a i icial ish swa m (AFS) algo i hm we e used o
op imize he pa ame e s o he machine lea ning model. The me hod was es ed on KDD’99 Cup,
Gas Pipeline, and indus ial ield da ase s. The empi ical esul showed ha he p oposed model is
e icien wi h a ious a ack ypes.
In [
33
], he au ho s in oduced he Fuzzi ied Cuckoo based clus e ing echnique o anomaly
de ec ion. The echnique consis s o wo phases: he aining phase and he de ec ion phase. In he
aining phase, cuckoo sea ch op imiza ion (CSO), k-means clus e ing, and decision ee c i e ion
(DTC) we e combined o e alua e he dis ance unc ions. In he de ec ion phase, a uzzy decisi e
app oach was u ilized o iden i y he anomalies based on inpu da a and p e iously compu ed dis ance
unc ions. Expe imen al esul s showed ha he model was e ec i e wi h an accu acy a e o 97.77%
and a alse ala m a e o 1.297%.
Meanwhile, he au ho s in [
34
] inco po a ed a i icial bee colony and a i icial ish swa m
algo i hms o cope wi h he complex IDS p oblems. In his wo k, a hyb id classi ica ion me hod
based on he ABC and AFS algo i hms was p oposed o imp o e he de ec ion accu acy o IDS.
The NSL-KDD and UNSW-NB15 da ase s we e used o e alua e he pe o mance o he me hod.
Based on he esul s ob ained, he p oposed model was e icien wi h a low alse ala m a e and high
accu acy a e.
In la e esea ch, Ga g e al. [
35
] p oposed a hyb id model o ne wo k anomaly de ec ion in
cloud en i onmen s. The model u ilized g ay wol op imiza ion (GWO) and a con olu ional neu al
ne wo k (CNN) o ea u e ex ac ion and iden i ying he anomalies in eal- ime ne wo k a ic s eams.
The empi ical esul showed ha he p oposed model was e icien wi h a low alse ala m a e and
high de ec ion a e.
Ano he app oach [
36
] p esen ed a hyb id IDS u ilizing spa k ML and he con olu ional-LSTM
ne wo k. The ISCX-UNB da ase was used o e alua e he pe o mance o he me hod. Based on
he esul s ob ained, he p oposed model ob ained a signi ican esul and ou pe o med he
compa ed me hod.
In e e ence [
37
], he au ho s adop ed he i e ly algo i hm o ea u e selec ion and he C4.5
Bayesian ne wo ks classi ie o de ec ion ne wo k in usion. The p oposed app oach was es ed on
he KDD’99 Cup da ase , and ob ained a p omising esul and ou pe o med he compa ed me hod o
ea u e selec ion.
Recen ly, esea ch conduc ed by Gu e al. [
38
] in oduced an IDS based on SVM wi h he
abu-a i icial bee colony o ea u e selec ion and pa ame e op imiza ion simul aneously. The main
con ibu ions o hei wo k included he adop ing o he abu sea ch algo i hm o imp o e he
neighbo hood sea ch o ABC, so ha i could speed up he con e gence and p e en ge ing s uck
in he local op imum. Acco ding o hei expe imen s, al hough he accu acy a e was high, 94.53%,
he alse ala m a e was 7.028%.
Table 3abs ac s some cha ac e is ics o he discussed ne wo k in usion de ec ion app oaches,
conce ning he ocus a eas, echniques, ea u es, he da ase s, and alida ion me ics used o e alua e
Symme y 2020,12, 410 16 o 24
6.1.2. AI Used in Social Enginee ing A acks
AI can be le e aged o mine la ge amoun s o big da ase s con aining social ne wo k da a o ex ac
pe sonally iden i iable in o ma ion, which can be used o comp omising use accoun s. Wha is mo e,
based on use in o ma ion, malicious ac o s could adop AI o gene a e cus om malicious links o
c ea e pe sonalized phishing emails au oma ically.
The e ha e been s udies on adop ing AI o ca y ou complex social enginee ing a acks. In [
66
,
67
],
he au ho s in oduced a long sho - e m memo y (LSTM) neu al ne wo k ha was ained on social
media pos s o manipula e use s in o clicking on decep i e URLs.
6.2. AI as a Tool o A acking AI Models
As AI is being in eg a ed in o secu i y solu ions, cybe c iminals a emp o exploi ulne abili ies
in his domain. A acks on AI sys ems a e ypically discussed in he con ex o ad e sa ial machine
lea ning. The o enses on AI sys ems o en appea ed in h ee a eas:
•
Ad e sa ial inpu s: This is a echnique whe e malicious ac o s design he inpu s o make
models p edic e oneously in o de o e ade de ec ion. Recen s udies demons a ed how
o gene a e ad e sa ial malwa e samples o a oid de ec ion. The au ho s o [
68
,
69
] c a ed
ad e sa ial examples o a ack he And oid malwa e de ec ion model. Meanwhile, schola s in [
70
]
p esen ed a gene a i e ad e sa ial ne wo k (GAN) based algo i hm called MalGAN o c a
ad e sa ial samples, which was capable o bypassing black-box machine lea ning-based de ec ion
models. Ano he app oach by Ande son e al. [
71
] adop ed GAN o c ea e ad e sa ial domain
names o a oid he de ec ion o domain gene a ion algo i hms. The au ho s in [
72
] in es iga ed
ad e sa ial gene a ed me hods o a oid de ec ion by DL models. Meanwhile, in [
73
], he au ho s
p esen ed a amewo k based on ein o cemen lea ning o a acking s a ic po able execu able
(PE) an i-malwa e engines.
•
Poisoning aining da a: In his kind o a ack, he malicious ac o s could pollu e he aining da a
om which he algo i hm was lea ning in such a way ha educed he de ec ion capabili ies o he
sys em. Di e en domains a e ulne able o poisoning a acks; o example, ne wo k in usion,
spam il e ing, o malwa e analysis [74,75].
•
Model ex ac ion a acks: These echniques a e used o econs uc he de ec ion models o eco e
aining da a ia black-box examina ion [
76
]. On his occasion, he a acke lea ns how ML
algo i hms wo k by e e sing echniques. F om his knowledge, he malicious ac o s know wha
he de ec o engines a e looking o and how o a oid i .
Table 9desc ibes he main de ails o he selec ed s udies ocusing on malicious use o AI,
wi h ega d o he ocus a ea, he echniques, he inno a ion poin , and he main idea. The ac onyms
o his able a e gi en in Table 10.

Symme y 2020,12, 410 17 o 24
Table 9. Selec ed e e ences in e m o he malicious use o AI.
Re e ences Yea Focus Tech. Inno a ion Poin Main Idea
[71] 2016 Ad e sa ial
a acks GAN New a ack
model c ea e ad e sa ial domain names o a oid he
de ec ion o domain gene a ion algo i hms
[76] 2016 S ealing
model AE model ex ac ion
a acks ex ac a ge ML models by he machine lea ning
p edic ion APIs
[66] 2016
Social
enginee ing
a acks RNN New a ack
model Au oma ed spea phishing campaign gene a o
o social ne wo k
[63] 2017 Comp omise
compu e Encoding
DNAs
Encoding
malwa e
o DNAs
comp omise he compu e by encoding malwa e in
a DNA sequence
[68] 2017 Ad e sa ial
a acks AE New a ack
algo i hm ad e sa ial a acks agains deep lea ning based
And oid malwa e classi ica ion
[69] 2017 Ad e sa ial
a acks AE New a ack
algo i hm use he ad e sa ial examples me hod o conduc new
malwa e a ian s o malwa e de ec o s
[70] 2017 Ad e sa ial
a acks GAN New a ack
model
p esen a GAN based algo i hm o c a malwa e
ha capable o bypass black-box
machine lea ning-based de ec ion models
[61] 2018 Malwa e
c ea ion DNN AI-powe ed
malwa e Le e age deep neu al ne wo k enhance malwa e,
make i mo e e asi e and high a ge ing
[62] 2018 Malwa e
c ea ion GAN AI-powe ed
malwa e a oid de ec ion by simula ing he beha io s
o legi ima e applica ions
[64] 2018 Malwa e
c ea ion ACO SI-based
malwa e use ACO algo i hms o c ea e a p o o ype malwa e
ha ha e a decen alize beha io
[73] 2018 Ad e sa ial
a acks AL New a ack
me hod a gene ic black-box o a acking s a ic po able
execu able machine lea ning malwa e models
[72] 2018 Ad e sa ial
a acks AM New a ack
algo i hm ad e sa ial gene a ed me hods o a ack
neu al ne wo k-based malwa e de ec ion
[74] 2018 Poisoning
a ack EPD New poisoning
da a me hod p esen a no el poisoning app oach ha a ack agains
machine lea ning algo i hms used in IDSs
[75] 2018 Poisoning
a ack AM
Analysis
poisoning
da a me hod
p esen h ee kind o poisoning a acks on machine
lea ning-based mobile malwa e de ec ion
[67] 2018
Social
enginee ing
a acks LSTM New a ack
model in oduced a machine lea ning me hod o
manipula e use s in o clicking on decep i e URLs
[65] 2019 Malwa e
c ea ion ANN nex gene a ion
malwa e use swa m base in elligence, neu al ne wo k o
o m a new kind o malwa e
Table 10. The ac onyms used in Table 9.
GAN: Gene a i e ad e sa ial ne wo k
AE: Ad e sa ial Examples
SI: Swa m In elligen
ANN: A i icial Neu al Ne wo k
RL: Rein o cemen lea ning
AMB: Ad e sa ial Malwa e Bina ies
EPD: Edge pa e n de ec ion
RNN: Recu en neu al ne wo k
DNN: Deep neu al ne wo k
ACO: An colony op imiza ion
AM: Ad e sa ial machine lea ning
LSTM: Long sho e m memo y
7. Challenges and Open Resea ch Di ec ions
In his sec ion, we discuss he challenges when adop ing AI-based app oaches in p ac ice.
Addi ionally, we also o e a ision abou some a eas ha need o be u he esea ch.
7.1. Challenges
AI me hods ha e played a c ucial ole in cybe secu i y applica ions and will con inue in a
p omising di ec ion ha a ac s in es iga ions. Howe e , some issues mus be conside ed when
applying AI-based echniques in cybe secu i y. Fi s , he accu acy o AI models is a signi ican ba ie .
Symme y 2020,12, 410 18 o 24
Speci ically, alse ala ms can was e p ocessing ime, o an AI sys em migh miss a cybe a ack en i ely.
Ano he ba ie o adop ion is ha many o he app oaches p oposed oday a e model- ee me hods.
These models equi e a la ge quan i y o aining da a, which a e ha d o ob ain in eal cybe secu i y
p ac ice. Nex , in designing AI-based solu ions o cybe secu i y, app oaches need o conside he
ad e sa y. Ad e sa ial a acks a e ha d o de ec , p e en , and coun e agains as hey a e pa o a
ba le be ween AI sys ems.
AI can help p o ec he sys em agains cybe - h ea s bu can also acili a e dange ous a acks; i.e.,
AI-based a acks. Malicious ac o s can le e age AI o make a acks lexible and mo e sophis ica ed o
bypass de ec ion me hods o pene a e compu e sys ems o ne wo ks.
7.2. Open Resea ch Di ec ions
The e a e di e se p omising and open opics o inco po a ing AI echniques and cybe secu i y.
Some esea ch a eas a e as ollows.
Fi s , he combina ion o se e al AI-based echniques in a de ense solu ion may s ill an in e es ing
esea ch di ec ion. Fo example, he inco po a ion o bio-inspi ed compu a ion and ML/DL app oaches
shows p omising esul s in malwa e de ec ion [
18
–
22
] o [
36
–
38
] o de ec ing he ne wo k in usion.
Hence, he combina ion o hese wo echniques is a e y po en ial esea ch di ec ion due o he numbe
o bio-inspi ed algo i hms exploi ed in cybe secu i y s ill being limi ed.
Second, he co po a ion be ween a human in ellec and machines o cybe de ense also needs
s udy. In his human–machine model, he agen s will au onomously execu e he ask whils humans
can supe ise and in e ene only when necessa y.
Thi d, he e is li e a u e p o ing ha he h ea ac o s could u ilize he AI-based me hod o bypass
o a ack he AI models, such as in [
68
–
72
,
75
–
77
]. Hence, he de ense s a egy agains hese ypes o
a acks would be an ine i able end in he u u e.
Ano he aspec ha necessi a es being s udied is he use o AI in malwa e, such as in [
61
,
64
,
65
].
Speci ically, he combina ion o swa m communica ion and o he AI-based echniques. Such malwa e
will exhibi ex emely high obus ness o in o ma ion p ese a ion agains swa m ne wo k damage.
Swa m communica ion also exposes he esea ch di ec ion o apply his idea o o he malwa e, such as
wo ms, ojans, o ansomwa e so ha hei ac i i ies can be mo e dis ibu ed and s eal h.
8. Discussion
The u iliza ion o AI in cybe secu i y c ea es new on ie s o secu i y in es iga ions. Scien is s
iew AI as an essen ial esponse o he con inuous g ow h in he numbe o and he inc ease in he
complexi y o cybe - h ea s, and he need o a quick eac ion and subs an ially au oma ic esponses o
secu i y a acks. On he o he hand, AI echnology also leads o some secu i y issues ha need o be
esol ed. In his sec ion, we summa ize he essen ial poin s in his s udy. O he me hods o enhance
cybe secu i y a e also men ioned. To conclude, he au ho s compa ed his s udy wi h se e al exis ing
su eys.
I is clea om he li e a u e ha AI-based app oaches could be adop ed in he cybe domain,
encompassing a a ie y o me hods ha ha e de eloped o e many decades, ha e demons a ed
e ec i eness, and a e cu en ly in use.
A p esen , he p ime a ge s o AI applica ions a e malwa e classi ica ion and analysis, in usion
de ec ion ( ocusing on anomaly ne wo k-based a acks), phishing and spam, and ad anced pe sis en
h ea de ec ion and cha ac e iza ion. Fu he mo e, a apidly eme ging opic o applica ion is
au oma ed ulne abili y es ing and in usion esis ance.
In usion de ec ion sys ems ypically ely on hyb idiza ion echniques ha combine se e al
me hods: signa u e-based me hods o apid de ec ion o known h ea s wi h low alse ala m a es
and anomaly-based me hods o lag de ia ions. Wha is mo e, ano he end is combining wi h o he
compu a ional in elligen models, such as ACO and PSO.
Symme y 2020,12, 410 19 o 24
The absence o da ase s o esea ch and de elopmen in ne wo k in usion is a p oblem.
P ecisely, publicly a ailable da ase s a e ex emely da ed, such as DARPA (1998), KDD (1999),
and NSL-KDD (2009), and he cha ac e is ics and olume o a acks ha e signi ican ly changed
since ha ime. Wha is mo e, he majo i y use o hese da ase s may o e a one-sided ision abou
collec ed da a and no e lec eal-wo ld si ua ions.
The e a e indica ions ha AI-based models can be bypassed. Se e al published examples in
he cybe secu i y ield indica e ha he AI sys em can be challenged wi h he ad e sa ial inpu s o
poisoning he aining da a. Fu he mo e, he po en ial h ea s o malicious use o AI need o be aken
in o accoun . Fo example, AI echnology can be u ilized o powe malwa e, es ablish a spea -phishing
campaign, o pe o m a social enginee ing a ack.
Besides hose p e iously men ioned opics, o he esea ch di ec ions o enhance cybe secu i y
we e also paid a en ion. Fo ins ance, in [
78
] he au ho s conduc ed a su ey abou he use o
Kolmogo o complexi y in he secu i y and p i acy domains. The adop ion o hese echnologies in
he cybe secu i y ealm was inspi ed by he ea u e ee na u e, and he absence o a need o une
he pa ame e s.
In his wo k, we e iewed di e en AI echniques and me hods used in de ending agains
cybe - h ea s a acks and o e ed a ision o malicious use o AI echnology as po en ial h ea s.
In o de o ensu e he no el y and new con ibu ion o ou su ey, we ho oughly compa ed ou wo k
wi h exis ing su eys, as shown in Table 11.
Table 11. A compa ison be ween ou su eys and exis ing su eys in he li e a u e.
Con en
Yea
Re e ences
[7] [8] [6] [3] [4] [5] [2]This
Su ey
2018 2018 2018 2018 2018 2019 2019 2019
AI me hods Machine lea ning x x x x x x
Deep lea ning x x x x x x
Bio-inspi e compu ing x x
De ense applica ions Malwa e de ec ion x x x x x x x x
In usion de ec ion x x x x x x x
Phishing de ec ion x x x x x x
Spam iden i ica ion x x x x x
APTs de ec ion x x x x
DGAs de ec ion x x x x
Malicous use o AI Ai-powe d malwa e x x
A ack agains AI x x x x
Social enginee ing a acks x x
9. Conclusions
D ama ic ad ances in in o ma ion echnology ha e led o he eme gence o new challenges o
cybe secu i y. The compu a ional complexi y o cybe -a acks equi es new app oaches which a e
mo e obus , scalable, and lexible. This a icle ocuses on he applica ion o he AI-based echnique
in cybe secu i y issues. Speci ically, we p esen he applica ion o AI in malwa e de ec ion, in usion
de ec ion, APT, and o he domains, such as spam de ec ion and phishing de ec ion. Fu he mo e,
ou manusc ip o e s a ision o how AI could be adop ed o malicious use.
In con empo a y esea ch, he p ima y a ge s o AI applica ion in cybe secu i y a e ne wo k
in usion de ec ion, malwa e analysis and classi ica ion, phishing, and spam emails. In hose a eas, he
adop ion o DL g adually became he p ima y end. Fu he mo e, he combina ion o o he in elligen
echniques, such as bio-inspi ed me hods, oge he wi h ML/DL, also a ac ed he a en ion o
esea che s. Such combina ions yield e y p omising esul s and con inue a end o u he esea ch.
Al hough he ole o AI in esol ing cybe secu i y ma e s con inues o be esea ched, some o
he p oblems ha exis a ound he deploymen o AI-based de enses a e also s iking. Fo ins ance,
Symme y 2020,12, 410 20 o 24
he ad e sa ial a ack agains he AI models o he eme gence o au onomous in elligen malwa e.
Hence, esea ch on disco e ing solu ions o hese h ea s should be u he explo ed.
Au ho Con ibu ions:
All he au ho s a e esponsible o he concep o he pape , he esul s p esen ed, and
he w i ing, and con ibu ed equally o his wo k. All au ho s ha e ead and ag eed o he published e sion o
he manusc ip .
Funding: This esea ch ecei ed no ex e nal unding.
Acknowledgmen s:
The ollowing g an s a e acknowledged o he inancial suppo p o ided o his esea ch:
g an o SGS, numbe SP2020/78, VSB Technical Uni e si y o Os a a.
Con lic s o In e es : The au ho s decla e no con lic o in e es .
Abb e ia ions
The ollowing abb e ia ions a e used in his manusc ip :
AI A i icial in elligence
ML Machine lea ning
DL Deep lea ning
DT Decision ees
SVM Suppo ec o machines
KNN K-nea es neighbo
RF Random o es
AR Associa ion ule algo i hms
EL Ensemble lea ning
PCA P incipal componen analysis
FNN Feed o wa d neu al ne wo ks
CNNs Con olu ional neu al ne wo ks
RNN Recu en neu al ne wo ks
DBNs Deep belie ne wo ks
SAE S acked au oencode s
GANs Gene a i e ad e sa ial ne wo ks
RBMs Res ic ed Bol zmann machines
EDLNs Ensemble o deep lea ning ne wo ks
GA Gene ic algo i hms
ES E olu ion s a egies
ACO An colony op imiza ion
PSO Pa icle swa m op imiza ion
AIS A i icial immune sys ems (AIS)
Re e ences
1.
Buczak, A.L.; Gu en, E. A su ey o da a mining and machine lea ning me hods o cybe secu i y in usion
de ec ion. IEEE Commun. Su . Tu o . 2015,18, 1153–1176. [C ossRe ]
2.
To es, J.M.; Comesaña, C.I.; Ga cía-Nie o, P.J. Machine lea ning echniques applied o cybe secu i y. In . J.
Mach. Lea n. Cybe n. 2019, 1–14. [C ossRe ]
3.
Guan, Z.; Bian, L.; Shang, T.; Liu, J. When machine lea ning mee s secu i y issues: A su ey. In P oceedings
o he 2018 IEEE In e na ional Con e ence on In elligence and Sa e y o Robo ics (ISR), Shenyang, China,
24–27 Augus 2018; pp. 158–165.
4.
Xin, Y.; Kong, L.; Liu, Z.; Chen, Y.; Li, Y.; Zhu, H.; Gao, M.; Hou, H.; Wang, C. Machine lea ning and deep
lea ning me hods o cybe secu i y. IEEE Access 2018,6, 35365–35381. [C ossRe ]
5.
Be man, D.S.; Buczak, A.L.; Cha is, J.S.; Co be , C.L. A su ey o deep lea ning me hods o cybe secu i y.
In o ma ion 2019,10, 122. [C ossRe ]
6.
Wick amasinghe, C.S.; Ma ino, D.L.; Ama asinghe, K.; Manic, M. Gene aliza ion o Deep Lea ning o
Cybe -Physical Sys em Secu i y: A Su ey. In P oceedings o he IECON 2018—44 h Annual Con e ence o
he IEEE Indus ial Elec onics Socie y, Washing on, DC, USA, 21–23 Oc obe 2018; pp. 745–751.
7.
Ap uzzese, G.; Colajanni, M.; Fe e i, L.; Guido, A.; Ma che i, M. On he e ec i eness o machine and
deep lea ning o cybe secu i y. In P oceedings o he 2018 10 h In e na ional Con e ence on Cybe Con lic
(CyCon), Tallinn, Es onia, 30 May–1 June 2018; pp. 371–390.
Symme y 2020,12, 410 21 o 24
8.
Li, J.H. Cybe secu i y mee s a i icial in elligence: A su ey. F on . In . Technol. Elec on. Eng.
2018
,
19, 1462–1474. [C ossRe ]
9.
Xu, Z.; Ray, S.; Sub amanyan, P.; Malik, S. Malwa e de ec ion using machine lea ning based analysis o
i ual memo y access pa e ns. In P oceedings o he Con e ence on Design, Au oma ion & Tes in Eu ope,
Lausanne, Swi ze land, 27–31 Ma ch 2017; pp. 169–174.
10.
Chowdhu y, M.; Rahman, A.; Islam, R. Malwa e analysis and de ec ion using da a mining and machine
lea ning classi ica ion. In P oceedings o he In e na ional Con e ence on Applica ions and Techniques in
Cybe Secu i y and In elligence, Ningbo, China, 16–18 June 2017; pp. 266–274.
11.
Hashemi, H.; Azmoodeh, A.; Hamzeh, A.; Hashemi, S. G aph embedding as a new app oach o unknown
malwa e de ec ion. J. Compu . Vi ol. Hacking Tech. 2017,13, 153–166. [C ossRe ]
12.
Ye, Y.; Chen, L.; Hou, S.; Ha dy, W.; Li, X. DeepAM: A he e ogeneous deep lea ning amewo k o in elligen
malwa e de ec ion. Knowl. In . Sys . 2018,54, 265–285. [C ossRe ]
13.
McLaughlin, N.; Ma inez del Rincon, J.; Kang, B.; Ye ima, S.; Mille , P.; Seze , S.; Sa aei, Y.; T ickel, E.;
Zhao, Z.; Doupé, A.; e al. Deep and oid malwa e de ec ion. In P oceedings o he Se en h ACM on
Con e ence on Da a and Applica ion Secu i y and P i acy, Sco sdale, AZ, USA, 22–24 Ma ch 2017;
pp. 301–308.
14.
Li, J.; Sun, L.; Yan, Q.; Li, Z.; S isa-an, W.; Ye, H. Signi ican pe mission iden i ica ion o
machine-lea ning-based and oid malwa e de ec ion. IEEE T ans. Ind. In o m.
2018
,14, 3216–3225. [C ossRe ]
15.
Zhu, H.J.; You, Z.H.; Zhu, Z.X.; Shi, W.L.; Chen, X.; Cheng, L. D oidDe : E ec i e and obus de ec ion o
and oid malwa e using s a ic analysis along wi h o a ion o es model. Neu ocompu ing
2018
,272, 638–646.
[C ossRe ]
16.
Ka bab, E.B.; Debbabi, M.; De hab, A.; Mouheb, D. MalDoze : Au oma ic amewo k o and oid malwa e
de ec ion using deep lea ning. Digi . In es ig. 2018,24, S48–S59. [C ossRe ]
17.
Wang, W.; Zhao, M.; Wang, J. E ec i e and oid malwa e de ec ion wi h a hyb id model based on deep
au oencode and con olu ional neu al ne wo k. J. Ambien In ell. Humaniz. Compu .
2019
,10, 3035–3043.
[C ossRe ]
18.
Ab Razak, M.F.; Anua , N.B.; O hman, F.; Fi daus, A.; A i i, F.; Salleh, R. Bio-inspi ed o ea u es op imiza ion
and malwa e de ec ion. A ab. J. Sci. Eng. 2018,43, 6963–6979. [C ossRe ]
19.
Al ahe , A.; Ba ukab, O.M. In elligen Hyb id App oach o And oid Malwa e De ec ion based on
Pe missions and API Calls. In . J. Ad . Compu . Sci. Appl. 2017,8, 60–67. [C ossRe ]
20.
Bha acha ya, A.; Goswami, R.T.; Mukhe jee, K. A ea u e selec ion echnique based on ough se and
imp o ised PSO algo i hm (PSORS-FS) o pe mission based de ec ion o And oid malwa es. In . J. Mach.
Lea n. Cybe n. 2019,10, 1893–1907. [C ossRe ]
21.
Alejand e, F.V.; Co és, N.C.; Anaya, E.A. Fea u e selec ion o de ec bo ne s using machine lea ning
algo i hms. In P oceedings o he 2017 In e na ional Con e ence on Elec onics, Communica ions and
Compu e s (CONIELECOMP), Cholula, Mexico, 22–24 Feb ua y 2017; pp. 1–7.
22.
Fa ima, A.; Mau ya, R.; Du a, M.K.; Bu ge , R.; Masek, J. And oid Malwa e De ec ion Using Gene ic
Algo i hm based Op imized Fea u e Selec ion and Machine Lea ning. In P oceedings o he 2019 42nd
In e na ional Con e ence on Telecommunica ions and Signal P ocessing (TSP), Budapes , Hunga y, 1–3 July
2019; pp. 220–223.
23.
Al-Yaseen, W.L.; O hman, Z.A.; Naz i, M.Z.A. Mul i-le el hyb id suppo ec o machine and ex eme
lea ning machine based on modi ied K-means o in usion de ec ion sys em. Expe Sys . Appl.
2017
,
67, 296–303. [C ossRe ]
24.
Kabi , E.; Hu, J.; Wang, H.; Zhuo, G. A no el s a is ical echnique o in usion de ec ion sys ems. Fu u e Gene .
Compu . Sys . 2018,79, 303–318. [C ossRe ]
25.
Ash aq, R.A.R.; Wang, X.Z.; Huang, J.Z.; Abbas, H.; He, Y.L. Fuzziness based semi-supe ised lea ning
app oach o in usion de ec ion sys em. In . Sci. 2017,378, 484–497. [C ossRe ]
26.
Shone, N.; Ngoc, T.N.; Phai, V.D.; Shi, Q. A deep lea ning app oach o ne wo k in usion de ec ion.
IEEE T ans. Eme g. Top. Compu . In ell. 2018,2, 41–50. [C ossRe ]
27.
Hamamo o, A.H.; Ca alho, L.F.; Sampaio, L.D.H.; Ab ão, T.; P oença, M.L., J . Ne wo k anomaly de ec ion
sys em using gene ic algo i hm and uzzy logic. Expe Sys . Appl. 2018,92, 390–402. [C ossRe ]

Symme y 2020,12, 410 22 o 24
28.
Bo es, F.H.; Leenen, L.; De La Ha pe, R. An colony induced decision ees o in usion de ec ion.
In P oceedings o he 16 h Eu opean Con e ence on Cybe Wa a e and Secu i y, Dublin, I eland, 29–30 June
2017; pp. 53–62.
29. O e o, F.E.; F ei as, A.A.; Johnson, C.G. Inducing decision ees wi h an an colony op imiza ion algo i hm.
Appl. So Compu . 2012,12, 3615–3626. [C ossRe ]
30.
Sya i , A.R.; Ga a, W. In usion de ec ion sys em using hyb id bina y PSO and K-nea es neighbo hood
algo i hm. In P oceedings o he 2017 11 h In e na ional Con e ence on In o ma ion & Communica ion
Technology and Sys em (ICTS), Su abaya, India, 31 Oc obe 2017; pp. 181–186.
31.
Ali, M.H.; Al Mohammed, B.A.D.; Ismail, A.; Zolkipli, M.F. A new in usion de ec ion sys em based on as
lea ning ne wo k and pa icle swa m op imiza ion. IEEE Access 2018,6, 20255–20261. [C ossRe ]
32.
Chen, W.; Liu, T.; Tang, Y.; Xu, D. Mul i-le el adap i e coupled me hod o indus ial con ol ne wo ks
sa e y based on machine lea ning. Sa . Sci. 2019,120, 268–275. [C ossRe ]
33.
Ga g, S.; Ba a, S. Fuzzi ied cuckoo based clus e ing echnique o ne wo k anomaly de ec ion.
Compu . Elec . Eng. 2018,71, 798–817. [C ossRe ]
34.
Hajisalem, V.; Babaie, S. A hyb id in usion de ec ion sys em based on ABC-AFS algo i hm o misuse and
anomaly de ec ion. Compu . Ne w. 2018,136, 37–50. [C ossRe ]
35.
Ga g, S.; Kau , K.; Kuma , N.; Kaddoum, G.; Zomaya, A.Y.; Ranjan, R. A Hyb id Deep Lea ning based Model
o Anomaly De ec ion in Cloud Da acen e Ne wo ks. IEEE T ans. Ne w. Se . Manag. 2019. [C ossRe ]
36.
Khan, M.A.; Ka im, M.; Kim, Y. A Scalable and Hyb id In usion De ec ion Sys em Based on he
Con olu ional-LSTM Ne wo k. Symme y 2019,11, 583. [C ossRe ]
37.
Sel akuma , B.; Muneeswa an, K. Fi e ly algo i hm based ea u e selec ion o ne wo k in usion de ec ion.
Compu . Secu . 2019,81, 148–155.
38.
Gu, T.; Chen, H.; Chang, L.; Li, L. In usion de ec ion sys em based on imp o ed abc algo i hm wi h
abu sea ch. IEEJ T ans. Elec . Elec on. Eng. 2019,14. [C ossRe ]
39.
Smadi, S.; Aslam, N.; Zhang, L. De ec ion o online phishing email using dynamic e ol ing neu al ne wo k
based on ein o cemen lea ning. Decis. Suppo Sys . 2018,107, 88–102. [C ossRe ]
40.
Jain, A.K.; Gup a, B.B. Towa ds de ec ion o phishing websi es on clien -side using machine lea ning based
app oach. Telecommun. Sys . 2018,68, 687–700. [C ossRe ]
41.
Feng, F.; Zhou, Q.; Shen, Z.; Yang, X.; Han, L.; Wang, J. The applica ion o a no el neu al ne wo k in he
de ec ion o phishing websi es. J. Ambien . In ell. Humaniz. Compu . 2018, 1–15. [C ossRe ]
42.
Sahingoz, O.K.; Bube , E.; Demi , O.; Di i, B. Machine lea ning based phishing de ec ion om URLs.
Expe Sys . Appl. 2019,117, 345–357. [C ossRe ]
43.
Li, Y.; Yang, Z.; Chen, X.; Yuan, H.; Liu, W. A s acking model using URL and HTML ea u es o phishing
webpage de ec ion. Fu u e Gene . Compu . Sys . 2019,94, 27–39. [C ossRe ]
44.
Feng, W.; Sun, J.; Zhang, L.; Cao, C.; Yang, Q. A suppo ec o machine based nai e Bayes algo i hm o spam
il e ing. In P oceedings o he 2016 IEEE 35 h In e na ional Pe o mance Compu ing and Communica ions
Con e ence (IPCCC), Las Vegas, NV, USA, 9–11 Decembe 2016; pp. 1–8.
45.
Kuma esan, T.; Palanisamy, C. E-mail spam classi ica ion using S-cuckoo sea ch and suppo ec o machine.
In . J. Bio-Inspi ed Compu . 2017,9, 142–156. [C ossRe ]
46.
Soh abi, M.K.; Ka imi, F. A ea u e selec ion app oach o de ec spam in he Facebook social ne wo k. A ab. J.
Sci. Eng. 2018,43, 949–958. [C ossRe ]
47.
Aswani, R.; Ka , A.K.; Ila a asan, P.V. De ec ion o spamme s in wi e ma ke ing: A hyb id app oach using
social media analy ics and bio inspi ed compu ing. In . Sys . F on . 2018,20, 515–530. [C ossRe ]
48.
Fa is, H.; Ala’M, A.Z.; Heida i, A.A.; Alja ah, I.; Ma a ja, M.; Hassonah, M.A.; Fuji a, H. An in elligen
sys em o spam de ec ion and iden i ica ion o he mos ele an ea u es based on e olu iona y andom
weigh ne wo ks. In . Fusion 2019,48, 67–83. [C ossRe ]
49.
Moon, D.; Im, H.; Kim, I.; Pa k, J.H. DTB-IDS: An in usion de ec ion sys em based on decision ee using
beha io analysis o p e en ing APT a acks. J. Supe compu . 2017,73, 2881–2895. [C ossRe ]
50.
Sha ma, P.K.; Moon, S.Y.; Moon, D.; Pa k, J.H. DFA-AD: A dis ibu ed amewo k a chi ec u e o he
de ec ion o ad anced pe sis en h ea s. Clus . Compu . 2017,20, 597–609. [C ossRe ]
51.
Rosenbe g, I.; Sica d, G.; Da id, E.O. DeepAPT: Na ion-s a e APT a ibu ion using end- o-end deep neu al
ne wo ks. In P oceedings o he In e na ional Con e ence on A i icial Neu al Ne wo ks, Alghe o, Sa dinia,
I aly, 11–14 Sep embe 2017; pp. 91–99.
Symme y 2020,12, 410 23 o 24
52.
Bu nap, P.; F ench, R.; Tu ne , F.; Jones, K. Malwa e classi ica ion using sel o ganising ea u e maps and
machine ac i i y da a. Compu . Secu . 2018,73, 399–410. [C ossRe ]
53.
Gha i , I.; Hammoudeh, M.; P enosil, V.; Han, L.; Hega y, R.; Rabie, K.; Apa icio-Na a o, F.J. De ec ion o
ad anced pe sis en h ea using machine-lea ning co ela ion analysis. Fu u e Gene . Compu . Sys .
2018
,
89, 349–359. [C ossRe ]
54.
Lison, P.; Ma oeidis, V. Au oma ic de ec ion o malwa e-gene a ed domains wi h ecu en neu al models.
a Xi 2017, a Xi :1709.07102.
55.
Cu in, R.R.; Ga dne , A.B.; G zonkowski, S.; Kleymeno , A.; Mosque a, A. De ec ing DGA domains wi h
ecu en neu al ne wo ks and side in o ma ion. a Xi 2018, a Xi :1810.02023.
56.
Yu, B.; Pan, J.; Hu, J.; Nascimen o, A.; De Cock, M. Cha ac e le el based de ec ion o DGA domain names.
In P oceedings o he IEEE 2018 In e na ional Join Con e ence on Neu al Ne wo ks (IJCNN), Rio de Janei o,
B azil, 8–13 July 2018; pp. 1–8.
57.
T an, D.; Mac, H.; Tong, V.; T an, H.A.; Nguyen, L.G. A LSTM based amewo k o handling mul iclass
imbalance in DGA bo ne de ec ion. Neu ocompu ing 2018,275, 2401–2413. [C ossRe ]
58.
Wang, Z.; Dong, H.; Chi, Y.; Zhang, J.; Yang, T.; Liu, Q. DGA and DNS Co e Channel De ec ion Sys em
based on Machine Lea ning. In P oceedings o he 3 d In e na ional Con e ence on Compu e Science and
Applica ion Enginee ing, Sanya, China, 22–24 Oc obe 2019; p. 156.
59.
Yang, L.; Zhai, J.; Liu, W.; Ji, X.; Bai, H.; Liu, G.; Dai, Y. De ec ing Wo d-Based Algo i hmically Gene a ed
Domains Using Seman ic Analysis. Symme y 2019,11, 176. [C ossRe ]
60. Thanh, C.T.; Zelinka, I. A Su ey on A i icial In elligence in Malwa e as Nex -Gene a ion Th ea s. Mendel
2019,25, 27–34. [C ossRe ]
61.
S oecklin, M.P. DeepLocke : How AI Can Powe a S eal hy New B eed o Malwa e. Secu . In ell.
2018
,8.
A ailable online: h ps://secu i yin elligence.com/deeplocke -how-ai-can-powe -a-s eal hy-new-b eed-
o -malwa e/ (accessed on 8 Feb ua y 2020).
62.
Rigaki, M.; Ga cia, S. B inging a gan o a kni e- igh : Adap ing malwa e communica ion o a oid de ec ion.
In P oceedings o he 2018 IEEE Secu i y and P i acy Wo kshops (SPW), San F ancisco, CA, USA, 24 May
2018; pp. 70–75.
63.
Ney, P.; Kosche , K.; O ganick, L.; Ceze, L.; Kohno, T. Compu e Secu i y, P i acy, and DNA Sequencing:
Comp omising Compu e s wi h Syn hesized DNA, P i acy Leaks, and Mo e. In P oceedings o he
26 h USENIX Secu i y Symposium (USENIX Secu i y 17), Vancou e , BC, Canada, 16–18 Augus 2017;
pp. 765–779.
64.
Zelinka, I.; Das, S.; Siko a, L.; Šenkeˇ ík, R. Swa m i us-Nex -gene a ion i us and an i i us pa adigm?
Swa m E ol. Compu . 2018,43, 207–224. [C ossRe ]
65.
T uong, T.C.; Zelinka, I.; Senke ik, R. Neu al Swa m Vi us. In Swa m, E olu iona y, and Meme ic Compu ing
and Fuzzy and Neu al Compu ing; Sp inge : Be lin, Ge many, 2019; pp. 122–134.
66.
Seymou , J.; Tully, P. Weaponizing da a science o social enginee ing: Au oma ed E2E spea phishing on
Twi e . Black Ha USA 2016,37.# =00:17,00:54. [C ossRe ]
67.
Seymou , J.; Tully, P. Gene a i e Models o Spea Phishing Pos s on Social Media. a Xi
2018
,
a Xi :1802.05196.
68.
G osse, K.; Pape no , N.; Manoha an, P.; Backes, M.; McDaniel, P. Ad e sa ial examples o malwa e
de ec ion. In P oceedings o he Eu opean Symposium on Resea ch in Compu e Secu i y, Oslo, No way,
11–15 Sep embe 2017; pp. 62–79.
69.
Yang, W.; Kong, D.; Xie, T.; Gun e , C.A. Malwa e de ec ion in ad e sa ial se ings: Exploi ing ea u e
e olu ions and con usions in and oid apps. In P oceedings o he 33 d Annual Compu e Secu i y
Applica ions Con e ence, O lando, FL, USA, 4–8 Decembe 2017; pp. 288–302.
70.
Hu, W.; Tan, Y. Gene a ing ad e sa ial malwa e examples o black-box a acks based on GAN. a Xi
2017
,
a Xi :1702.05983.
71.
Ande son, H.S.; Woodb idge, J.; Fila , B. DeepDGA: Ad e sa ially- uned domain gene a ion and de ec ion.
In P oceedings o he 2016 ACM Wo kshop on A i icial In elligence and Secu i y, Vienna, Aus ia, 28 Oc obe
2016; pp. 13–21.
72.
Kolosnjaji, B.; Demon is, A.; Biggio, B.; Maio ca, D.; Giacin o, G.; Ecke , C.; Roli, F. Ad e sa ial malwa e
bina ies: E ading deep lea ning o malwa e de ec ion in execu ables. In P oceedings o he 2018 26 h
Eu opean Signal P ocessing Con e ence (EUSIPCO), Rome, I aly, 3–7 Sep embe 2018; pp. 533–537.
Symme y 2020,12, 410 24 o 24
73.
Ande son, H.S.; Kha ka , A.; Fila , B.; E ans, D.; Ro h, P. Lea ning o e ade s a ic PE machine lea ning
malwa e models ia ein o cemen lea ning. a Xi 2018, a Xi :1801.08917.
74.
Li, P.; Liu, Q.; Zhao, W.; Wang, D.; Wang, S. BEBP: An poisoning me hod agains machine lea ning based idss.
a Xi 2018, a Xi :1803.03965.
75.
Chen, S.; Xue, M.; Fan, L.; Hao, S.; Xu, L.; Zhu, H.; Li, B. Au oma ed poisoning a acks and de enses in
malwa e de ec ion sys ems: An ad e sa ial machine lea ning app oach. Compu . Secu .
2018
,73, 326–344.
[C ossRe ]
76. T amè , F.; Zhang, F.; Juels, A.; Rei e , M.K.; Ris enpa , T. S ealing machine lea ning models ia p edic ion
apis. In P oceedings o he 25 h USENIX Secu i y Symposium (USENIX Secu i y 16), Aus in, TX, USA, 10–12
Augus 2016; pp. 601–618.
77.
Ca lini, N.; Liu, C.; E lingsson, Ú.; Kos, J.; Song, D. The sec e sha e : E alua ing and es ing
unin ended memo iza ion in neu al ne wo ks. In P oceedings o he 28 h USENIX Secu i y Symposium
(USENIX Secu i y 19), San Diego, Cali o nia, CA, USA, 14–16 Augus 2019; pp. 267–284.
78.
Resende, J.S.; Ma ins, R.; An unes, L. A Su ey on Using Kolmogo o Complexi y in Cybe secu i y. En opy
2019,21, 1196. [C ossRe ]
c
2020 by he au ho s. Licensee MDPI, Basel, Swi ze land. This a icle is an open access
a icle dis ibu ed unde he e ms and condi ions o he C ea i e Commons A ibu ion
(CC BY) license (h p://c ea i ecommons.o g/licenses/by/4.0/).