# Applications of Artificial Intelligence to Network Security

**Authors:** Alberto Perez Veiga  
**arXiv:** [1803.09992](https://arxiv.org/abs/1803.09992)  
**Date:** 2018-03-27  
**Summary page:** https://www.summarizepaper.com/en/paper/1803.09992v1/

## Key points

- Attacks on networks are becoming more complex and sophisticated
- Traditional approaches to network security are reaching their limits
- There is a growing recognition of the need for a smarter approach to threat detection
- Artificial intelligence (AI) can be applied in network security
- Self-organizing maps (SOMs) can be used for automated analysis in network security
- Data science combined with unsupervised machine learning techniques, such as hidden Markov models (HMMs), can achieve more accurate results
- Darktrace's "Enterprise Immune System" algorithm emulates the human body's defense mechanism against infections
- Darktrace's system can detect and defend against malicious activity without relying on rules or known datasets
- Darktrace has successfully detected new strains of complex ransomware attacks in real-time
- AI in network security shows promising potential as organizations invest in these technologies to combat emerging threats.

## Summary

Attacks on networks are becoming increasingly complex and sophisticated, with professional attackers seeking to infiltrate corporate networks for profit. Traditional approaches to network security are reaching their limits, and there is a growing recognition of the need for a smarter approach to threat detection. This paper explores the application of artificial intelligence (AI) in network security and offers a high-level overview of state-of-the-art AI techniques. One example mentioned is the use of self-organizing maps (SOMs), which are created through automated analysis rather than using parsers or taxonomies. The paper also discusses how data science can be combined with unsupervised machine learning (ML) techniques, such as hidden Markov models (HMMs), to achieve more accurate results. HMMs have traditionally been applied in fields like speech recognition and biological analysis but can also be used in an unsupervised ML environment where there is no clear sample data. The practical case study of Darktrace showcases how companies are leveraging AI and ML to enhance their security solutions. Darktrace has developed an algorithm called "Enterprise Immune System" that emulates the human body's defense mechanism against infections by differentiating between "good" and "bad" cells. Darktrace's system can detect and defend against malicious activity without relying on rules or known datasets. Darktrace's success stories include detecting new strains of complex ransomware attacks in real-time. In one instance, an employee accessed their personal email from the corporate network, allowing malware to enter and encrypt files on SMB shares; however, Darktrace's engine flagged this behavior as malicious within seconds even when the security team was unavailable. Overall, this paper highlights the need for advanced techniques in network security due to evolving attack methods and demonstrates how AI can be applied effectively through examples like SOMs, HMMs, and Darktrace's innovative approach. The future of AI in network security looks promising as organizations continue to invest in these technologies to combat emerging threats.