Source-linked AI summary
The Role of Machine Learning in Cybersecurity
Giovanni Apruzzese, Pavel Laskov, Edgardo Montes de Oca, Wissam Mallouli, Luis Burdalo Rapa, Athanasios Vasileios Grammatopoulos, Fabio Di Franco
TL;DR
Cybersecurity needs adaptive defenses, yet ML deployment remains slower than research progress and the field lacks a comprehensive understanding of ML’s role. The paper synthesizes scientific and industrial knowledge across cybersecurity, identifies benefits and deployment problems, and examines challenges through two industrial applications. It concludes that advancing operational ML cybersecurity requires informed tradeoffs, pragmatic research, real data, and coordinated stakeholder effort.
Problem
Cybersecurity requires adaptation to changing environments and threats, but existing knowledge does not clearly establish ML’s role or reconcile research with operational practice.
Method
The paper provides a comprehensive meta-review combining scientific literature, technical reports, industrial experience, stakeholder perspectives, and two real deployment case studies.
Results
The paper identifies ML benefits and additional cybersecurity capabilities, elucidates intrinsic deployment problems, and outlines challenges requiring contributions from multiple stakeholders.
Takeaways & Limitations
ML cybersecurity progress depends on understanding operational tradeoffs and pursuing pragmatic developments supported by real data and coordinated stakeholder contributions.
Takeaways & Limitations
Real ML deployments face limited transparency in commercial black-box solutions and difficult interpretation, especially for deep learning.
Abstract
from arXiv · showhide
Machine Learning (ML) represents a pivotal technology for current and future information systems, and many domains already leverage the capabilities of ML. However, deployment of ML in cybersecurity is still at an early stage, revealing a significant discrepancy between research and practice. Such discrepancy has its root cause in the current state-of-the-art, which does not allow to identify the role of ML in cybersecurity. The full potential of ML will never be unleashed unless its pros and cons are understood by a broad audience. This paper is the first attempt to provide a holistic understanding of the role of ML in the entire cybersecurity domain -- to any potential reader with an interest in this topic. We highlight the advantages of ML with respect to human-driven detection methods, as well as the additional tasks that can be addressed by ML in cybersecurity. Moreover, we elucidate various intrinsic problems affecting real ML deployments in cybersecurity. Finally, we present how various stakeholders can contribute to future developments of ML in cybersecurity, which is essential for further progress in this field. Our contributions are complemented with two real case studies describing industrial applications of ML as defense against cyber-threats.
1 INTRODUCTION
The paper addresses the persistent gap between ML cybersecurity research and operational practice by offering a comprehensive, accessible analysis of ML’s benefits, problems, challenges, and deployments.
- Motivation: Cybersecurity defenses must adapt quickly to mutating environments and dynamic threats, requirements that static and human-defined methods cannot meet.
- Research–practice gap: Despite extensive research and widespread organizational use of AI/ML tools, integrating ML into production cybersecurity progresses slowly.
- Scope and approach: The paper analyzes ML’s benefits for cyberthreat detection, including network intrusion, malware, and phishing detection.
- Scope and approach: It also examines ML applications beyond detection, such as alert filtering, report compression, cross-source correlation, and organizational weak-spot identification.
- Challenges and contributions: The paper elucidates intrinsic ML problems, deployment tradeoffs, future challenges, and the contributions required from regulators, executives, engineers, and researchers.
- Industrial perspective: Two industrial case studies connect research with practice by describing operational tradeoffs and implementation techniques in commercial ML security products.
2 BACKGROUND AND MOTIVATION
This section introduces ML concepts, model development, performance assessment, and the paper’s broad scope, audience, and relationship to prior work.
- ML foundations: ML develops models that learn from training data and make decisions on future data, with validation required before operational deployment.
- ML foundations: Labels determine whether ML methods are supervised or unsupervised; supervised learning requires labelled training data, whereas unsupervised methods may operate without labels.
- ML foundations: Deep learning uses neural networks and handles complex data, while shallow ML can perform similarly on datasets with few features using fewer resources and offering easier interpretation.
- Performance assessment: Accuracy can mislead in cyber-threat detection because malicious activities are rare relative to benign samples, making positive and negative outcomes important distinctions.
- Scope and related work: The paper bridges research and operational practice through a comprehensive, accessible overview of ML’s benefits, problems, recommendations, and research directions across cybersecurity.
- Scope and related work: Unlike prior studies with narrower applications or excessive technical depth, the paper addresses decision makers, security professionals, researchers, engineers, and other stakeholders.
3 MACHINE LEARNING FOR THREAT DETECTION
ML supports cyberthreat detection through both supervised and unsupervised approaches, extending beyond detection to broader cybersecurity tasks. Reported applications show strong results, but deployment choices involve labeling costs, evasion risks, and unresolved questions about deep learning’s superiority.
- Detection approaches: ML can support both misuse-based and anomaly detection by learning patterns from large amounts of data.The paper identifies the association of ML exclusively with anomaly detection as a misconception.
- Network intrusion detection: Unsupervised methods can detect attacks, support rule generation, and identify lateral movement without requiring complete network labels.Reported examples include detecting over 75% of attacks absent from security feeds and over 90% recall with 10% false positives for lateral movement.
- Network intrusion detection: Unsupervised network detection improved the detection rate from below 1% to over 95% while maintaining a false positive rate below 0.1%.The passage also reports commercial botnet detection via DNS analysis with less than 0.1% false positives.
- Network intrusion detection: Supervised NIDS approaches are more expensive because they require good-quality labels, but reported systems achieve strong precision, detection, and F1 results.Examples include over 95% precision, over 97% precision, almost 95% detection, and an F1-score increase from 0.90 to 0.95 when temporal dependencies are included.
- Additional cybersecurity roles: Beyond threat detection, ML can analyze heterogeneous raw data for alert management, risk assessment, and threat intelligence, often without extensive human labeling.These roles include filtering, prioritizing, or fusing alerts and extracting security insights from abundant raw data.
5 INTRINSIC PROBLEMS OF MACHINE LEARNING IN CYBERSECURITY
ML can address many cybersecurity roles, but deployment remains difficult because cybersecurity’s adversarial, dynamic, and sensitive environment conflicts with ML assumptions. These intrinsic constraints, plus development and product tradeoffs, require careful evaluation and coordinated future work.
- General problems: Concept drift makes long-term ML use unreliable because evolving devices, services, and users quickly render training data obsolete.The changing environment conflicts with the iid assumption underlying reliable application of ML.
- General problems: Cybersecurity’s adversarial setting exposes ML systems to changing offensive strategies, zero-day attacks, and adversarial samples targeting the models themselves.These threats arise because cybersecurity implicitly assumes active adversaries who refine their strategies.
- General problems: Confidentiality constraints can make ML systems unusable when sensitive traffic is encrypted, such as HTTP payload inspection under HTTPS.Data-privacy sensitivity is a strong barrier to long-term reliance on ML in cybersecurity.
- In-house development: In-house development requires difficult initial algorithm, data, and tuning choices, followed by costly maintenance to reflect current trends.Even small training-data changes can reduce performance and require additional manual trial-and-error work.
- Commercial products: COTS products trade development effort for limited scope and transparency, with performance often tied to vendor environments and opaque decisions.Commercial models may not fit organization-specific data, while reported metrics can be meaningless without contextualization.
- Future directions: The paper argues that ML risks must be addressed through standardized certification, pragmatic research, and joint contributions from regulators, executives, engineers, and researchers.Certification should cover performance and robustness, while future work must account for the intrinsic risks of cybersecurity’s dynamic ecosystem.
8 CONCLUSION
The paper provides a broad, accessible overview of ML’s benefits, applications, problems, and future challenges across cybersecurity. It also clarifies misconceptions and presents operational industrial case studies.
- The paper explains ML’s role across the entire cybersecurity sphere while minimizing technical terminology for broad accessibility.
- It summarizes security ML misconceptions discussed throughout the paper in Table 3.
- It covers ML applications for malware, phishing, and network-intrusion detection, plus raw-data analysis, alert management, cyber-risk estimation, and threat intelligence.
- The paper describes fundamental operational problems and future challenges requiring contributions from regulators, executives, engineers, and the scientific community.
- Two successful, operational industrial deployments of ML are presented as case studies for countering cyber threats.