Businesses today face an ever-evolving landscape of cyber threats. Threat actors have weaponised artificial intelligence (AI) to launch targeted attacks with unimaginable precision and speeds. The scale and breadth of attacks have also increased. At any given time, there are 300+ known threat actors active, each with unique motivations and tactics. Darktrace reports a 135% surge in “novel social engineering” attacks during the first three months of 2023. This correlates with the widespread adoption of ChatGPT. 

The sheer volumes and the dynamic nature of such AI-driven attacks renders static defence mechanisms ineffective. Conventional signature-based antivirus and rule-based intrusion detection systems cannot identify these attacks.

The solution is a proactive cyber-security strategy. A key component of such a strategy is threat intelligence. Threat intelligence involves collecting, analysing, and sharing information on cyber threats. Such actionable information helps enterprises improve their security posture and make effective defences. Threat intelligence becomes even better with Artificial Intelligence (AI). AI-powered threat intelligence allows cyber security to fight fire with fire. They can thwart AI-powered attacks using the same technology. 

Identifying the sources of threat data 

The first step in thwarting any attack is information.

Stopping an attack requires understanding the nature of the attack. Cyber security needs to know the who, what, when, where, why, and how of the attack. They need information on the attacker’s identity and modus operandi, among other information.

But cyber security teams often struggle to get such actionable threat data. Conventional tools have limited data-gathering capabilities. Most of these tools struggle to cope with the sheer volumes of data in today’s digital age. To put things in perspective, Microsoft alone collects over 65 trillion signals daily. Synthesising such information using conventional tools is impossible.

AI-based threat intelligence systems can capture data from a wide range of sources, including:

• Traditional data sources such as network logs and security alerts.
• User behavioural data.
• Data from public sources such as social media platforms.
• External threat feeds such as open-source intelligence (OSINT)
• Unconventional sources, such as dark web forums. These sources often remain out-of-bounds for conventional tools and methods.

AI adds context and metadata, such as geolocation, timestamps, and indicators of compromise (IOCs), to the collected data. AI tools also leverage natural language processing (NLP) to decipher the meaning and intent of data. These insights allow classifying threats based on severity and impact. 

AI-based systems also learn and update from new data to keep the threat identification exercise current and relevant.

Deeper analysis

Traditional threat intelligence involves manual data analysis. This is laborious, time-intensive, and, nowadays, inadequate. These methods, that rely on static signatures, cannot keep up with the attacker’s changing tactics.

AI automates data analysis and makes the process more efficient and scalable. 

Machine Learning algorithms analyse large datasets in double-quick time. It

• Identifies patterns, trends, and suspicious behaviours that humans or conventional tools miss. For instance, the algorithms detect phishing by analysing content, sender, attachments, and links. Conventional tools may only look at the sender and the text. 
• Study typical user behaviour and flag deviations and anomalies. For instance, if a user accesses sensitive data at odd hours or from an unusual location, the system immediately flags it as a potential insider threat. It also takes the recommended action, such as blocking the user, notifying the system admin and or shutting down the network..
• Scan networks for potential weaknesses. The analytics engine compares current data and trends with historical data to predict threats. 
• Unearth correlations. Attackers often reuse code snippets and command and control servers across campaigns. Statistical modelling uncovers these hidden connections scattered across huge volumes of threat data. Security analysts use such insights for proactive threat identification. They use these insights to link attacks that seem disparate but are part of broader coordinated campaigns.

Predictive analytics transforms cyber security from a reactive stance to a proactive strategy. Enterprises can use such insights to take proactive patches and foil attackers before they strike. 

Customised threat profile

Not all threats or situations are equal. Threat actors may target some enterprises that hold attractive data. Enterprises with spread-out networks and many branches may be more at risk of phishing attacks. Companies with poor Human Resources practices may be at greater risk of insider threats.  

AI systems correlate intelligence with internal company data to build customised threat profiles. These profiles highlight the risks relevant to the enterprise. 

Automated threat response

Threat intelligence is useless without an effective mechanism to act on such intelligence. Threat actors work at lightning speed, and cyber security needs to respond immediately to mitigate the damage.

AI-powered systems automate critical incident responses, such as:

• Isolating infected systems.
• Blocking malicious activity.
• Applying predefined responses to known threats.
• Shutting down the network when faced with unknown threats.
• Notifying security teams.

Such automated actions shrink the time for adversaries to exploit weaknesses and lessen the attack’s impact.

Cybersecurity teams can use AI to orchestrate the incident response process. Such orchestration enables a complete and comprehensive response. It also facilitates a proactive approach to warding off threats rather than limiting to a reactive approach. The old-school reactive approach to security struggles to thwart zero-day exploits. The new AI-powered orchestrated approach can sense trouble ahead and take instant countermeasures.

Shared Responsibility 

The dissemination of technology has made cyber security everyone’s responsibility. Sharing threat intelligence information with relevant stakeholders becomes critical in such a context. Sharing data spreads awareness and improves enterprises’ security posture. But traditional sharing methods, which are mostly manual, are too slow and inadequate.

Machine learning makes data sharing fast and easy. Algorithms determine the type of information to share and the recipients of such information. AI algorithms check the trust level of the parties and if sharing information is legal and ethical. They also protect sensitive data by encrypting confidential information before sharing it.

AI systems can use feedback to track how well the ecosystem shares threat information. They measure results to see if the sharing is effective.

Conclusion

While AI holds much promise, realising such promise depends on using the right tools to leverage the benefits. Fortinet offers an integrated AI-powered platform that wards off the most potent cyber threats. Fortinet’s coverage extends across all users, devices, and edges and enables lightning-fast responses. A consolidated security operations platform accelerates time to detect and respond. A unified SASE ensures secure access and protects data on any cloud.