The use of emerging technologies creates vulnerabilities in an enterprise which fraudsters can exploit. Recent report by Capgemini stated that 42% of companies reported an increase in incidents through time-sensitive applications. Nowadays, security technology makes use of innovative technologies like Artificial Intelligence. Being a part of AI, Machine Learning (ML) has many applications and it is being used to analyze threats and respond to incidents. It has been found to be effective against malware detection due to its ability to resolve fuzzy problems.
- Against Spear Phishing Attack: Verizon’s 2019 Data Breach Investigations Report revealed that it is the top threat action variety in all breaches analyzed, which makes one of the most widely used attacks in the world, usually targeted towards company staff. It makes use of a victim’s communication tool, like emails and social media platforms, to send malicious contents to unsuspecting recipients to deceive the victim into clicking or downloading the content or attachment, thereby by-passing internal security mechanisms. To detect the threat, organisations can store Meta data from emails but avoid compromising user’s privacy. This will help the ML algorithm to detect discrepancies in patterns that reveal malicious sender’s emails.
- Against Watering Hole Attack: Similar to Spear phishing, however, the difference is that it appears to make use of a legal website or application that has already been compromised. The sites or apps are harmful and used to trick unsuspecting victims to provide their personal information via email. The ML algorithm can learn and detect communications that are common to the malicious website or apps, as well as detect unusual redirect patterns to and from the host site with other risk information.
- Against Credential Theft: The attacker employs watering hole or phishing attacks to obtain credentials from unsuspecting victims with the aim of obtaining sensitive information from the organization’s network, in many cases, the VPN may be compromised if present. Since login patterns can be left behind by internet users, ML can be used to learn possible behaviours from user patterns that pose a treat to the enterprise.
- Against Reconnaissance Attack: The attacker probes the network for susceptibilities in order to accumulate information about the network before launching an attack. The ML algorithm can be used to scan network activities, to identify changes in signature patterns that constitute malicious activities and detect the spread of new patterns in the network, thereby limiting the number of false positives.
- Remote Exploitation Attack: Malicious persons assess the network to identify susceptibility points and launch a series of attacks in order to sabotage the network and gain control of the system. The Machine Learning algorithm can learn and assess the network and identify harmful patterns that require further actions and alert your security personnel accordingly.
