The Role of Machine Learning in Cybersecurity

TL;DR

This paper provides a comprehensive overview of how machine learning can be applied in cybersecurity, highlighting its benefits, challenges, and future directions through case studies and stakeholder analysis.

Contribution

It offers the first holistic analysis of ML's role in cybersecurity, addressing advantages, intrinsic problems, and stakeholder contributions with real industrial case studies.

Findings

ML enhances detection capabilities over human methods

Identifies key challenges in deploying ML in cybersecurity

Provides case studies of ML applications in industry

Abstract

Machine Learning (ML) represents a pivotal technology for current and future information systems, and many domains already leverage the capabilities of ML. However, deployment of ML in cybersecurity is still at an early stage, revealing a significant discrepancy between research and practice. Such discrepancy has its root cause in the current state-of-the-art, which does not allow to identify the role of ML in cybersecurity. The full potential of ML will never be unleashed unless its pros and cons are understood by a broad audience. This paper is the first attempt to provide a holistic understanding of the role of ML in the entire cybersecurity domain -- to any potential reader with an interest in this topic. We highlight the advantages of ML with respect to human-driven detection methods, as well as the additional tasks that can be addressed by ML in cybersecurity. Moreover, we elucidate various intrinsic problems affecting real ML deployments in cybersecurity. Finally, we present how various stakeholders can contribute to future developments of ML in cybersecurity, which is essential for further progress in this field. Our contributions are complemented with two real case studies describing industrial applications of ML as defense against cyber-threats.