AI w cyberbezpieczeństwie

AI for cybersecurity · id cyberai · aliases: AI in cybersecurity, AI for cyber defence, security AI, LLM4Security, AI w cyberobronie, sztuczna inteligencja w bezpieczeństwie IT

Uczenie maszynowe i modele językowe w obronie systemów IT: wykrywanie włamań i malware, szukanie podatności, praca SOC oraz ataki wspomagane przez AI.

Machine learning and language models in defending IT systems: intrusion and malware detection, vulnerability discovery, SOC work and AI-assisted attacks.

In one sentence

Programy, które pomagają pilnować komputerów i sieci: wyłapują włamania, wirusy i dziury w oprogramowaniu, zanim wykorzysta je przestępca.

Software that helps guard computers and networks, catching break-ins, viruses and software holes before criminals use them.

Problem it solves

Ataków jest tak dużo, a specjalistów tak mało, że ludzie nie nadążają czytać alarmów ani łatać dziur w kodzie.

There are so many attacks and so few specialists that people can't keep up with the alarms or patch holes in code.

What it does

Jak strażnik z setką kamer, który nie męczy się w nocy: przegląda wszystko naraz, a ludziom zostawia decyzje w trudnych sprawach.

Like a guard watching a hundred cameras who never tires at night: scans everything at once and leaves the hard calls to people.

Everyday example

Pocztowy filtr odsyła do kwarantanny fałszywy mail z „fakturą” od rzekomego kontrahenta, zanim ktokolwiek w biurze go otworzy.

The mail filter quarantines a fake email with an 'invoice' from a supposed supplier before anyone in the office opens it.

This concerns you if you…

• dostajesz podejrzane maile lub esemesy
• odpowiadasz za komputery w firmie lub szkole
• piszesz oprogramowanie używane przez innych
• get suspicious emails or text messages
• look after computers at a company or school
• write software that other people use

Subtopics

• AI po stronie atakującego i testy penetracyjne (Offensive AI and AI-assisted penetration testing): Using models and agents for reconnaissance, exploitation and social engineering, both in legitimate penetration tests and in real attacks.
  • Agenci testów penetracyjnych (LLM penetration-testing agents): Language agents planning and executing penetration-test steps: reconnaissance, scanning, exploitation and reporting, supervised by a tester.
  • Ataki prowadzone z pomocą AI (AI-enabled and AI-orchestrated cyberattacks): Use of models by criminals and state groups: from writing convincing phishing to agents carrying out most stages of an intrusion.
• AI w zespole reagowania (SOC) (AI for security operations (SOC)): Language models and agents supporting security analysts: alert triage, investigation, log analysis and threat-report analysis.
  • Analiza raportów o zagrożeniach (CTI) (Cyber threat intelligence analysis with language models): Language models extracting attack techniques, indicators of compromise and links to vulnerabilities from reports and bulletins in structured form.
    • Mapowanie opisów ataków na techniki MITRE ATT&CK (Automated mapping of threat text to ATT&CK techniques): Classifying sentences and threat reports into techniques and tactics from the MITRE ATT&CK catalogue, a multi-label text classification task.
  • Generowanie reguł detekcji z raportów o zagrożeniach (LLM-assisted detection rule generation): Using language models to turn attack descriptions and indicators from reports into detection rules in formats such as Sigma or YARA.
  • Triaż alertów i agenci śledczy (AI alert triage and investigation agents): Language agents that gather evidence from security tools for each alert, assess its credibility and prepare a justified verdict.
• Analiza programów binarnych i inżynieria wsteczna z AI (AI for binary analysis and reverse engineering): Models trained on machine code and disassembly output that support decompilation, name recovery, similar-function search and malware analysis without source code.
  • Dekompilacja z użyciem modeli językowych (Neural and LLM-based decompilation): Translating machine code, or a classic decompiler's output, into readable, compilable source code with language models.
  • Odzyskiwanie nazw zmiennych w zdekompilowanym kodzie (Neural variable-name recovery in decompiled code): Models learn to restore meaningful variable names lost during compilation by using lexical and structural context from decompiled code.
  • Wyszukiwanie podobnych funkcji w kodzie binarnym (Binary code similarity detection): Learning embeddings of binary functions so the same code compiled with different compilers, options or architectures lies close together.
• Szukanie i łatanie podatności z AI (AI-assisted vulnerability discovery and repair): Language models and agents that generate fuzz tests, read code for security bugs and propose fixes.
  • Bezpieczeństwo kodu pisanego przez AI (Security of AI-generated code): Measuring and reducing vulnerabilities in code produced by coding assistants and agents, via tests, benchmarks and secure-generation techniques.
  • Fuzzing wspomagany modelami językowymi (LLM-assisted fuzzing): Language models write and fix fuzzing harnesses and classify crashes, raising code coverage without manual work.
    • Generowanie sterowników fuzzingu przez modele językowe (LLM-based fuzz driver generation): Language models automatically writing the glue code that connects a fuzzer to a library's functions so random inputs reach deep into the tested code.
  • Systemy automatycznego znajdowania i łatania błędów (Cyber reasoning systems for automated find-and-patch): Autonomous systems combining fuzzing, static analysis and language models that find a vulnerability, confirm it and generate a tested patch.
    • Generowanie łatek na podatności przez modele językowe (LLM-based vulnerability patch generation): Generative models propose code changes intended to repair a known vulnerability. A candidate requires functional testing and security evaluation before use.
  • Wykrywanie podatności w kodzie przez modele językowe (Vulnerability detection in source code with language models): Language models and agents analysing source code and changes to flag security bugs and variants of known vulnerabilities.
• Wykrywanie zagrożeń i włamań (Threat and intrusion detection): Models that detect attacks in network traffic, system logs and email: classifying known patterns and flagging departures from normal behaviour.
  • Analiza zachowań użytkowników i zagrożenia wewnętrzne (UEBA) (User and entity behaviour analytics (UEBA) and insider threat detection): Modelling the typical behaviour of accounts, users and devices in an organisation and detecting deviations that suggest a hijacked account or a malicious insider.
  • Wykrywanie anomalii w logach systemów (Log anomaly detection): Learning models of event sequences from system and application logs to detect unusual runs that signal failures or attacks.
    • Parsowanie logów do szablonów zdarzeń (Automated log parsing): Automatically splitting raw log messages into a fixed event template and variable parameters, as the first step in anomaly detection and diagnostics.
  • Wykrywanie ataków na grafach pochodzenia zdarzeń systemowych (Provenance-graph-based intrusion detection): Detecting long-running stealthy attacks by analysing dependency graphs between processes, files and network connections in an operating system.
  • Wykrywanie losowo generowanych domen (DGA) (Detection of algorithmically generated domains (DGA detection)): Classifying domain names as algorithmically generated by malware to reach its command server, often from the character string alone.
  • Wykrywanie phishingu (Phishing detection): Classifying messages, URLs and webpages as phishing from their content, URL representation and visual similarity to legitimate brands.
  • Wykrywanie włamań w ruchu sieciowym (Machine-learning network intrusion detection): Classifiers and anomaly detectors trained on network flows and packets, separating normal traffic from attacks.
• Wykrywanie złośliwego oprogramowania (Machine-learning malware detection): Classifying files and program behaviour as malicious or benign from static and dynamic features.
  • Omijanie detektorów malware przykładami adwersarialnymi (Adversarial evasion of malware detectors): Modifying real malicious programs so they keep working while a classifier judges them benign, and defending against such attacks.
  • Starzenie się detektorów i realistyczna ocena w czasie (Concept drift and time-aware evaluation of malware detectors): Methods for evaluating and maintaining malware detectors that respect data chronology, realistic class ratios and performance decay over time.
  • Statyczna klasyfikacja plików wykonywalnych (Static malware classification of executables): Classifying executables (e.g. Windows PE files) as malicious or benign from features extracted without running the program.
  • Wykrywanie malware po zachowaniu w piaskownicy (Dynamic (behavioural) malware detection): Classifying programs from traces of their execution in an isolated environment, most often sequences of system API calls with their arguments.

Related topics

• Bezpieczeństwo i governance (AI safety, security and governance)

Sources

• Large Language Models for Cyber Security: A Systematic Literature Review · Hanxiang Xu, Shenao Wang, Ningke Li, Kailong Wang, Yanjie Zhao, Kai Chen, Ting Yu, Yang Liu, Haoyu Wang
• A Survey of Agentic AI and Cybersecurity: Challenges, Opportunities and Use-case Prototypes · Sahaya Jestus Lazer, Kshitiz Aryal, Maanak Gupta, Elisa Bertino
• Dos and Don'ts of Machine Learning in Computer Security · Daniel Arp, Erwin Quiring, Feargus Pendlebury, Alexander Warnecke, Fabio Pierazzi, Christian Wressnegger, Lorenzo Cavallaro, Konrad Rieck