Prospective Artificial Intelligence Approaches for Active Cyber Defence

TL;DR

This paper reviews AI-based active cyber defense strategies, focusing on reinforcement learning and causal inference, to counter increasingly sophisticated cyber threats leveraging AI.

Contribution

It updates the research roadmap for AI in active cyber defense, emphasizing reinforcement learning and causal inference as promising approaches.

Findings

Reinforcement learning can adapt to dynamic cyber threats.

Causal inference helps identify attack causes and improve defenses.

AI approaches could shift the balance towards defenders.

Abstract

Cybercriminals are rapidly developing new malicious tools that leverage artificial intelligence (AI) to enable new classes of adaptive and stealthy attacks. New defensive methods need to be developed to counter these threats. Some cybersecurity professionals are speculating AI will enable corresponding new classes of active cyber defence measures -- is this realistic, or currently mostly hype? The Alan Turing Institute, with expert guidance from the UK National Cyber Security Centre and Defence Science Technology Laboratory, published a research roadmap for AI for ACD last year. This position paper updates the roadmap for two of the most promising AI approaches -- reinforcement learning and causal inference - and describes why they could help tip the balance back towards defenders.