AI in Cybersecurity - Chance or Just Another Hype

Today, I hope you had the great days, great free days. And you heard a lot about cybersecurity. My focus today is more on AI than on cybersecurity or, and I'm an expert more in AI for a lot of years, but I have only 80 minutes. That's my problem. So I can only give you a quick overview regarding what are the possibilities, but nevertheless, I want to share with you today, some tools and techniques, especially one technique. I use very often to use machine learning, especially also in cybersecurity. Let's start with NDA. I will start with one is AI and ML. And what is cybersecurity?

AI and cyber security are one specific use T case. In this case, I will show you a technique. And the last one most important thing is the questions you have to ask yourself. Should I implement on my own or reuse some techniques? The classical question make, or by let's start where I I'm in the it sector for around about 15 years, focusing on Azure and AWS in the context, only of AI in my roles, in my daily life. I'm executive AI consultant for the CGI. And you are heard it a few minutes ago.

I'm also representative for the chairman AI cessation, especially for about and leading the local group. What is AI? That's easy and a very hard question because there are, I would say a lot of definitions. I will summarize it in one sentence for me, it's the definition of automation of intelligent behavior and machine learning, intelligent behavior.

I, what I mean by that, that is kind of cognitive things. You can hear. You can hear something, you can see something, you can understand something and machine learning, machine learning. I want to go deeper in this topic and I want to show you what is machine learning all about? But before we start, I have to really talk about strong and weak AI. What's the difference you maybe always heard about strong and weak AI because we have to categorize them between these two categories. The first one is weak AI. Current applications are only limited on one task are very specific on one task.

For example, they have also fixed domain models and or they can only solve one problem. And that is really good. And there is no real transfer between this two things. So they are, they aren't able nowadays to learn something and to transfer to a complete other task. Another one is some thing for the future. The strong AI, the idea is that there is a combination between weak AI to a strong AI. So I can perform many tasks like a human can understand many inputs, for example, it can under, he can, or she can understand images and sounds and combine it to a greater understanding.

What is machine learning machine learning? I will pick out the two main categories, supervised learning and unsupervised learning. The first one, the algorithm is classification and regression. That means if I, I want to classify a specific problem, I want, I have, for example, a lot of house prices. And I want to try to predict the house prices based on specific parameters. For example, parameters, how small or huge is the house, how many rooms, bathrooms, and so on here, you see some usages and that is also the spam folder is a spam yes or no price predictions. And it works with label data.

We have this kind of a training phase in this phase. You give the algorithm a lot of data input data. For example, I mentioned it before a lot of input data, for example, the characteristics of in house or flat and output is the price in the prediction phase. Also called inference phase. You can give them some new parameters. And during the training, the algorithm tries to understand the correlation between this in parameters. The difference is unsupervised learning. In this case, I have no label data, the algorithm price on their own that I have some categories. For example, some clustering.

It will also cluster some data into groups and tries to categorize them and to new possibilities, to understand your data. For example, it is also animal detection. The last project was basket analysis, but this is also the most important technique in my daily life that Isly, and it could be animal detection from the differentiation between for the different usage of a memory. It could be also which visitors accessing my resources on my computer or on my server or on the cloud. And that is in my case, the most important or algorithm I always using how it works.

It's as I mentioned before, it works without labels and tries to find hidden paper and not papers and patterns. The last one is reinforcement learning. That is only not the topic for the day. That is only that you heard it.

It, I can compare it like the learning of a baby. You have a baby, and that is in reinforcement learning an agent and the baby tries to interact with the environment. So also the agent in reinforcement learning, and it will gain some re rewards from the environment or getting not some robot. For example, the baby falls down. It tries to walk and especially a funny story three weeks ago and become a father. So I really see how reinforcement learn the, the baby learned like reinforcement learning.

It will try some things and he cries a lot, especially at night, to be honest, but I want to compare it to, for the reinforcement learning. It tries and becomes some reword. And on this reword, it will figure out the strategy. I categorize cybersecurity only a quick overview in this categories later on, I will share the presentation for you.

I want to show you this categories because there is a lot of possibilities and that is also a chance also, but also hype, because if you have a lot of use cases and I can only tell you a story, I was at the client's place and he offered me kind of 500 use cases for AI 500 possible use cases. And this is, this is not, not so, so good for, for the straightforward plan, because that is the, it could be too much possibilities. So for example, we have here only this, this area or this categories with excess management, you can so do so things, so much things regarding also anomaly detection.

And also based on this categories you can have and make some good and achievable use cases, AI and cybersecurity. It is important to, with a very good use case. What is a good use case? In my opinion, in my opinion is two categories. The first one, which effort you have to put in, for example, do you have dependencies to other vendors? Do you have still your resources with your colleagues? Do they have the knowledge to train on the model on their own? And what will you become? For example, you will have a great return and invest.

And these two categories in my daily life, I try to try to figure out for each use case. And so I know which is the first use case we can start with and you see the picture.

That's, that's a problem. When you have too much use cases and to find this use cases, I want to show you free decision trees, how it helps me to think about which use cases are even possible. I mentioned it before supervised learning. It's all about classification and regression. You have here classification, for example, divide the socks by colors or divider ties by length. And you have here the differentiation between to groups and here is it will generate a function that is closely to the given data.

In comparison you have here the most common used algorithm clustering, you can find similar things, implement all also protective basket analysis on this techniques, but you have also this dimension reduction that is only for the usage that you can reduce your data and for the best output. The other thing is, sorry, it's, it is kind of too technical, but it's very important that you understand, and that is that you have for your need for your data, much more examples. So if you want, for example, you want to try to implement your own detection on based on the data for the logins.

And then it is not help helpful if you have only one lock in from person and that, that you want, let them in. That is two less data to, to train your model. In this case, there is say a lot of redefined and also ready to use solution. Then I would recommend to use this because it's very important to have some, to have data because without good data and without data, without bias, it's very important and very hard to train a good algorithm to use. The last one is I want to don't want to make advertisement for Azure, but when I make some algorithms on Azure, it is very important to use this.

This is for example, you have the idea, would you want expect information? You will want recommend recommendations. Do we want to predict something? This will help you to find the category of algorithms you can use, but when you implement this, this is not only just machine learning code, you have much more. And I always see in my project that when the ML code is ready, there is much more to do. You can see it here. There is a model training, and this is also part of ML code, but this is also the serving infrastructure.

You have to, you want to consume your infrastructure and your machine learning code. And also very important to monitor in my case use case. I can't get so deep, sorry about that. The time is running out, but I share everything all resources later on. So you can see the presentation also in detail. This is very important regarding the question. Should I make my own algorithm? And this gives you a quick insight. That is real much more than only training the algorithm you have also to choose the algorithm regarding detection there so much variety of possibilities.

You can contact me later on and I can share, share with you the possibilities also that is, that would be too long for this presentation, but to give you an insight, it can be also supervised learning, but also unsupervised learning or combination it's called semi-supervised learning. That's also very good. Semi-supervised learning. If you have small amount of data, it will help you to start with this algorithm also with a small amount of data, because supervised learning requires a lot of data. And it's very important that you have this kind of data to summarize.

It's very important that you have the resources. If you want to make it on your own, or you choose to go into the cloud. For example, I have good experience in Azure regarding firewall, and also some techniques that the algorithms regarding anomal detection is also integrate in their products directly. The sentencing is, do we really need AI? That's a very important question. Sometimes it is enough. If you can have a kind of a decision tree, and then it's very important to think about, do I, do you really need AI for this specific case? And last one is you have to choose only one use case.

It's very important. As I mentioned before, that it has less dependencies that you can start and finish very easily. And upon this experience, you can BA you can follow the next use cases and also gain your experience on this. To sum it up. It's very important that you have this techniques because you, as a user know your specific domain, you know, your cybersecurity issues. And I want to provide you this tools that you can have a look for example, on your own, is this detection, the best one is a category sales classification, the best one.

And that is very important that you have this rough idea. What is machine learning and what are the characteristics of machine learning? You can contact me afterwards and I will share your further information. Thank you very much.