Machine Learning Applications for Cybersecurity

M.A. THOMAS SPRING 2023 | 87 ABSTRACT The trope of future cybersecurity as a battle between warring artificial intelligences awaits the development of artificial general intelligence. In the interim, however, machine learning is being applied to a number of cybersecurity problem sets. This article looks more closely at how machine learning is transforming cybersecurity, considering the examples of authentication and masquerade, spam filtering and spam, antimalware and malware, and intrusion detection and intrusion. Machine learning is adding new capabilities for cyber defense and in most cases is useful in conjunction with other approaches. At present, machine learning applications for cyber offense remain primarily proofs of concept. Aflurry of articles has warned that soon cybersecurity will be utterly transformed, becoming a battle between warring artificial intelligences that adapt to each other’s moves at “machine speed.” Like many claims in an era of artificial intelligence (AI) hype, the image is grounded in ideas of “artificial general intelligence,” AI programs that can solve a wide range of problems at least as well as a human. But artificial general intelligence is likely decades away at best—and some say that it is an impossibility. In the interim, “narrow” artificial intelligence is being used to develop applications for cybersecurity. The current dominant approach in artificial intelligence is machine learning (ML). ML programs use data to develop statistical or probabilistic models that can be used to classify, predict, or generate new examples. This is a work of the U.S. Government and is not subject to copyright protection in the United States. Foreign copyrights may apply. Machine Learning Applications for Cybersecurity M.A. Thomas 88 | THE CYBER DEFENSE REVIEW MACHINE LEARNING APPLICATIONS FOR CYBERSECURITY This article examines how ML applications are shaping cybersecurity today. It discusses four examples in which machine learning tools are currently being applied: authentication and masquerade attacks; spam filtering and spam; antimalware and malware; and intrusion detection and intrusion. ML is adding new tools to the toolbox, primarily for cyber defenders, but the inherent limitations of machine learning often mean that it is most useful in combination with other approaches. MACHINE LEARNING There is no consensus definition of “artificial intelligence,” a field of computer science that addresses problems previously thought to require human intelligence. Indeed, the definition is necessarily dynamic as innovation changes expectations of the kinds of problems computers can be used to solve. Much of the hyperbole about AI is focused on “artificial general intelligence” (also called “general artificial intelligence”), programs that can solve a wide range of problems at least as well as humans can. However, artificial general intelligence does not exist and is not on the near horizon. Some believe it to be impossible.1 Current AI is called “narrow AI,” meaning that the programs are crafted to solve narrowly defined problems. There are several families of approaches to artificial intelligence and approaches are often combined. For example, “first generation” artificial intelligence, or “expert systems,” seek to distill human domain expertise into hard-coded rules that are applied by the program to make the same types of judgments using the same criteria. An example application is the diagnosis of medical conditions.2 Another has attempted to mimic human reasoning by applying logical rules to data to reach conclusions, such as programs that verify models for quality control.3 Game-theoretic approaches use game theory to map out possible responses to precisely M.A. Thomas is a professor at the College of Information and Cyberspace at National Defense University. She holds a BA in computer and information science from the University of California, Santa Cruz, a JD from the University of California, Berkeley, and a PhD in political economy and government from Harvard University. Her work has appeared in leading academic and policy outlets, including Foreign Affairs, International Affairs, Defence Studies, and Strategic Studies Quarterly. M.A. THOMAS SPRING 2023 | 89 defined problems to determine which option is superior. This approach has been used to write programs that win at certain types of competitive games.4 However, the current dominant family of approaches in AI is machine learning, which involves building statistical and probabilistic models from data. The models are then applied to new data to make predictions, classify, or to generate new examples from a prompt. The field of ML has benefited from an explosion in the amount of data available for model generation (“training”) due to internet and cell phone usage, improvements in data storage, and increased computational power that enables the analysis of that data. ML models depend on human choices. Researchers select and analyze the input data and consider the desired outcome, deciding how the program will acquire data for model building, what variables (“features”) and data should be used for model building, what type of model to build, what algorithm to use to build the model, what parameters should be used in the model building process, and how rare cases will be handled. They curate and provide the training data to build the model, a process called “supervised learning,” or they may arrange for data to flow to the program without human curation (for example, from a sensor) in “unsupervised learning” or “reinforcement learning,” or they may use a combination of these approaches. The algorithm generates the model from the data, a process called “training” a model. Because the models are probabilistic and statistical, some cases will not be handled correctly. Developers must decide whether some kinds of mistakes are more important than others and what kind of metrics will be used to evaluate model performance. They then test the model on new data and tweak the model or its parameters to optimize performance.5 Narrow AI programs are brittle. Novel cases are not handled well because they were not represented in the model’s training data. In addition, if the relationship between model inputs and outputs changes, the model may no longer work as well or work at all, a phenomenon called “concept drift.”6 For example, a number of stock market models failed to correctly predict the behavior of the stock market during the COVID-19 pandemic.7 Finally, ML models can be defeated. A subfield of machine learning deals with the generation of adversarial examples deliberately designed to be misclassified by a given machine learning model. To generate such examples, researchers need some feedback about how new data are classified. Given that feedback, reverse engineering the model and generating adversarial examples is fairly straightforward.8 New tools for cybersecurity continue to be developed and deployed that use expert systems. But research and development of machine learning tools for cybersecurity have exploded in the last five years, in part because of the new availability of data for model training, such as the Github code repository and public malware repositories. Four cybersecurity problem sets highlight the contribution of ML tools: authentication and masquerade attacks, spam and spam filters, malware and antimalware, and intrusion detection. 90 | THE CYBER DEFENSE REVIEW MACHINE LEARNING APPLICATIONS FOR CYBERSECURITY AUTHENTICATION AND MASQUERADE A key element of cybersecurity is user authentication, a process used to confirm that a user is who they claim to be before granting access to a system or resource. Authentication factors are something you know, something you have, or something you are. Something you know may be a user password; something you have may be a second device like a cell phone; something you are may be your face or fingerprint. ML has enabled wider use of biometric authentication (something you are). In a masquerade attack, an attacker seeks to defeat authentication by masquerading as a legitimate user. ML has been used to conduct masquerade attacks by defeating CAPTCHA tests designed to ensure that users are human. Biometric Authentication Advances in machine learning have led to increased use of biometrics as means of authentication for many functions.9 Biometrics can be physiological, such as a person’s face, fingerprint, or iris; or behavioral, such as distinct patterns in keystrokes or voice. The biometric information is gathered with appropriate sensors, e.g., a camera for visual information or a microphone for voice information. It is then preprocessed to extract features of interest. These are fed into a classifier model to identify the individual. Both facial and fingerprint recognition are widely used for cybersecurity. An increasing number of smartphone manufacturers offer the ability to unlock a phone using facial or fingerprint recognition. Both Windows 10 and 11 offer the ability to unlock a laptop using facial recognition with the “Windows Hello” feature.10 The Government Accountability Office reported in 2021 that sixteen federal agencies have used facial recognition technology for employees to unlock their government-issued smartphones, while two are experimenting with it to authenticate users of government websites.11 Voice recognition is also used to access some websites. Biometric authentication is an attractive problem set for machine learning applications because the key features of faces or fingerprints are relatively stable over the period of interest. However, as with all machine learning programs, authentication programs make mistakes. They can also be defeated, including by presenting falsified data to sensors, intercepting and then replaying the identifying data, or using constructed data.12 Security researchers at Talos reported an 80% success rate in defeating fingerprint recognition, including on cell phones and laptops, using a fingerprint collected from a user and a 3D printer to create a replica.13 One response has been to attempt to develop ML programs that seek to distinguish between “live” users and static replicas, either by collecting more data through hardware sensors (such as blood pressure) or by software.14 Defeating CAPTCHA CAPTCHA (“Completely Automated Public Turing test to tell Computers and Humans Apart”) systems are tests designed to determine whether an online user is human in the effort to prevent automated account creation and access to web resources such as webmail forms. They M.A. THOMAS SPRING 2023 | 91 were initially developed at Carnegie Mellon University in 2000.15 An example task is to identify a visually distorted number. However, they can be challenging for the visually impaired. Accordingly, many also have an auditory form. Google originally acquired reCAPTCHA, one of the major CAPTCHA systems, as a way to leverage user image recognition to help with its book digitization project.16 Researchers have developed proof-of-concept machine learning attacks that bypassed CAPTCHA systems by using ML image recognition on visual CAPTCHAs and freely available machine learning speech recognition utilities on auditory versions.17 Google released “Invisible reCAPTCHA” the same year. Invisible reCAPTCHA uses machine learning to analyze the user’s browser behavior, such as mouse movements, to determine if the user is human.18 However, this approach relies on cookies to store information about user behavior. If a user used a new device or cleared cookies, the system defaulted to the older reCAPTCHA system, and so was easily defeated. As one security researcher commented, “The fact that Invisible reCAPTCHA can be bypassed isn’t because there was a fatal flaw in the design of the newer CAPTCHA. It’s that any reverse Turing test is inherently beatable when the pass conditions are known.”19 SPAM FILTERING AND SPAM Cybersecurity company Proofpoint estimates from its customer data that less than one percent of cyberattacks depend on system vulnerabilities. The majority depend on social engineering—deceiving people into sharing sensitive information, giving access, or downloading malware.20 A principal means of conducting such attacks is through “phishing” emails designed to trick users into sharing sensitive information. Verizon’s analysis of a sample of convenience of more than 157,000 incidents confirms that phishing attacks and credential theft eclipse attacks that involve the installation of malware.21 Phishing emails may be sent in bulk as spam, or they may be specially targeted to a particular user or group of users. Some cyberattacks simply require that the user open the email (“fileless” attacks). Others require the user to open an attachment, which then installs malware. Still others require the user to click on a link that downloads malware or that leads to a website that deceives the user into entering credentials that are then stolen. Phishing emails are designed to persuade the user to take the necessary action to complete the compromise. To reduce the incidence of this type of attack, as well as general nuisance emails, many email programs use email filters to classify incoming emails as spam or junk, which is then blocked or marked. The earliest spam filters relied on expert systems, hard-coded rules for classification based on an analysis of email traffic. Emails might be screened based on the addresses of senders, their headers, their content, or their language.22 Spam senders responded by adopting tools that randomize parts of the email message so that they could not be excluded by a hard-coded rule.23 Later filters used researcher-specified probabilistic or statistical models to evaluate whether an email is likely to be spam. 92 | THE CYBER DEFENSE REVIEW MACHINE LEARNING APPLICATIONS FOR CYBERSECURITY Machine learning approaches develop the models using data. They benefit from the public release of databases of emails to be used for model training.24 Email service providers can also draw on the corpus of emails that are sent and received by their users and user classifications of emails. The literature on machine learning approaches to spam filtering is sufficiently voluminous to have given rise to multiple, recent literature reviews.25 These approaches are usually combined. Google, for example, uses both rules-based and machine learning approaches to combat spam on its Gmail email platform and claims to be able to detect and block 99.99% of spam, phishing, and malware emails.26 It does not appear that spam senders are using machine learning approaches. However, researchers have developed a proof-of-concept spam generator that uses machine learning to evade a spam filter by learning which phrases cause a filter to identify an email as spam.27 As with all adversarial examples, this requires some feedback regarding how the email has been classified. In this case, the researchers had access to user inboxes and perfect information about how the email was classified. ANTIMALWARE AND MALWARE The Creeper was thought to be the first computer virus, designed in 1971 as a proof of concept, displaying the text, “I’m the creeper: catch me if you can!” It prompted the creation of the first antivirus program, The Reaper.28 Today, malicious software is used to wipe hard drives, steal sensitive information, commandeer computers and equipment or physically destroy them, or to establish “backdoors” for later access. The use of antimalware software to identify and quarantine malicious executable files on the end user’s computer is considered the last line of cybersecurity defense. To operate, antimalware software must be able to classify executable files as malicious or benign. Security researchers would also like to know what the malware does and how it operates so they can check it more effectively. The classic approach to this problem is through signature-based malware detection. Machine learning approaches have been applied to different parts of the problem of signature development and malware detection. They have also been used to identify malware without relying on a fixed signature. Signature-Based Malware Detection In signature-based malware detection, security researchers who identify suspicious code study the sample. First, they examine the executable file at rest (“static analysis”). They may reverse engineer it, translating the binary executable code into a higher-level format that allows them to better understand the program logic and actions. They may then run the program to see what it does (“dynamic analysis”). Because of the possibly malicious nature of the code, suspected malware is run in a virtual “sandbox” environment where its behavior can be closely monitored and where it has limited ability to affect the computer.29 M.A. THOMAS SPRING 2023 | 93 If the code is determined to be malicious, researchers attempt to identify a “signature,” unique blocks or features of the code that can be used to identify it. This signature is added to the database of signatures. The antimalware program scans the files on the hard drive or processes in memory, flagging and quarantining malware with those signatures if it is detected.30 This signature-based detection method can only detect known malware for which signatures have been developed but it is still useful. Existing malware is often reused. There is no need for malware developers to develop something new if the old tools will meet their objectives. However, malware developers do take steps to thwart the signature-development process and signature-based detection. Some malware is written to detect whether it is being run in a sandbox, and, if so, to terminate execution, preventing dynamic analysis. Developers may divide the malware into multiple files, encode or change strings, encrypt the files, or compress (“pack”) them to make reverse engineering or detection more difficult.31 A “stub” executable unpacks and runs the malicious payload. It is not uncommon for malware to have been subjected to multiple layers of encryption and packing. “Fileless” malware avoids writing files to the hard drive where they might be scanned, instead installing in firmware or remaining and running in memory and leveraging native operating system processes to further avoid detection.32 Fileless attacks have been growing exponentially, bypassing many antimalware programs. Machine learning approaches have been applied to different parts of this problem set. They include machine learning programs for reverse engineering and for identifying malware without using signatures. At the moment, malware that leverages machine learning remains proof of concept. Reverse Engineering One relevant application of machine learning is to facilitate reverse engineering. Computer programs are typically written in a high-level programming language in which a program is expressed as a set of tasks and then “compiled,” translated into binary code representing instructions and data for a specific type of computer processor. Humans cannot read and follow binary executables of any length or complexity. Reverse engineering, or “reversing,” translates binary code back into instructions that can be more easily understood by humans. Disassemblers translate binary into ”assembly language,” natural language representations of the instructions to the processor. Decompilers translate binary into a higher-level language program that carries out the same functions. In addition, there are programs that seek to capture and represent the program logic in forms other than a programming language, such as a control flow graph. Reversing is complicated by the fact that there is not a unique one-to-one mapping between high-level source code and a binary executable. The mapping depends on the compiler, the computer architecture, and code optimization options used during compilation, information that is typically not available to a security researcher.33 In addition, some information is lost 94 | THE CYBER DEFENSE REVIEW MACHINE LEARNING APPLICATIONS FOR CYBERSECURITY during the compilation process, such as natural language procedure and variable names that might explain what the purpose of a procedure is, the order in which procedures are called in execution, or information about where functions start and stop.34 In addition, developers may take steps to make reverse engineering of their code harder. Malware developers may wish to thwart security researchers. Developers of benign software may wish to protect their intellectual property or prevent tampering. Most commercial software licenses explicitly prohibit reversing for this reason. Examples of these kinds of measures are stripping strings and metadata that would provide clues to program functionality (“stripped” binary executables); using self-modifying code that overwrites its own instructions in memory; and using code that is encrypted at rest and only decrypted in execution.35 For these reasons, reversing has been a slow process conducted by a domain expert with software tools that are aids rather than solutions.36 Disassemblers and decompilers have historically used expert-system, rule-based approaches.37 There have been several efforts to facilitate reversing using machine learning. For example, researchers proposed a proof-of-concept machine learning model to decompile small snippets of code from binary, following methods that had been used for text translation.38 Others built on this approach, achieving greater accuracy by training a machine learning decompiler using code snippets compiled with a given compiler.39 However, with this approach, each combination of architecture, programming language, and optimization settings would need to be modeled independently. Other approaches have tackled subparts of the problem of reversing. For example, researchers have used machine learning to determine likely and descriptive names for functions in a stripped executable using control-flow graphs of application programming interface calls.40 Others have used machine learning for detecting similar sections of binary code or determining where functions start and stop.41 Research in this area is still in proof-of-concept phase. It seems likely that machine learning will provide additional tools for reverse engineering but will still fall short of producing a fully automated solution because of obfuscation and information lost in the compilation process and the steps taken to thwart reverse engineering. Malware Identification without Signatures Another active area of research is the use of machine learning to classify malware without reliance on hard-coded, manually produced signatures. Researchers build machine learning models of various features of static code or of code in execution.42 First generation efforts to use machine learning depended on researchers with expert domain knowledge to identify key features from static or dynamic analysis of malware to use as training data. Manually extracted static features include printable strings, application programming interface (API) function calls, function call graphs, control flow graphs, sequences of bytes and opcodes, or the M.A. THOMAS SPRING 2023 | 95 representation of the patterns of binary code as gray scale images, or a measure of entropy. Manually extracted dynamic features include memory and register usage, instruction traces, and network traffic and API call traces. The second generation uses deep learning to identify the important features from raw code or minimally processed data.43 Another effort uses the text reports generated by running software in a sandbox.44 Machine learning models are more flexible than hard-coded rules and can more easily rely on a wider variety of features to flag suspected malware. However, they will fail to detect novel malware in general and can also be fooled by adversarial examples. Researchers at Skylight Cyber fooled Blackberry Cylance’s PROTECT malware detection software simply by appending strings from a popular game to existing malware files.45 Environmentally Aware Malware Although, as of this writing, it is unclear that any malware detected in the wild uses machine learning, researchers have suggested proofs of concept. One example is the use of machine learning for environmentally aware malware. Environmentally aware malware classifies the environment and executes code based on this classification. This classification has historically been rules-based. For example, the malware may be designed to perform differently or not execute if it detects cues that it is in a sandbox or if it detects a process from a software analysis tool currently running, signals that it is under analysis by security researchers.46 In 2018, a security researcher reported that 98% of malware that his team analyzed in a sandbox used at least one evasive tactic and 32% used six or more.47 Alternately, environmentally aware malware may be targeted, designed to execute its payload only when it is running on a machine with certain characteristics. A famous example of targeted malware, Stuxnet, executed its payload only if conditions were met that described the equipment used for uranium enrichment at Iran’s Natanz facility.48 It sped the centrifuges up periodically while disguising this activity from operators, causing centrifuges to break. Classification problems are natural candidates for machine learning. Researchers have shown that it is possible to use machine learning, rather than expert systems, to classify the environment. For example, researchers at IBM developed DeepLocker, proof-of-concept malware that uses machine learning to determine whether it has reached the targeted machine and only then generates a decryption key used to unlock the payload, preventing reverse engineering.49 In their demonstration, DeepLocker triggered only when it recognized the face of a specific user, using the infected computer’s camera, another application of biometrics. INTRUSION DETECTION AND INTRUSION A final example of the use of machine learning for cybersecurity is in intrusion detection systems. Intrusion detection systems are used to detect unauthorized access to or use of computer systems and networks. They focus on patterns of network usage, system usage, or user behavior.