Abstract Artificial intelligence, machine learning, and cybersecurity are the topics of discussion of contemporary information technology sector and computing research. This study investigates the integration of machine learning-based artificial intelligence in the context of cybersecurity. This paper presents an overview of the recent literature, focusing on selected popular areas related to the challenges and opportunities that such implementations introduce. The authors also assess how selected problems related to the application of machine learning algorithms affect the real effectiveness represented by the resulting models. To support this analysis, an experimental study was conducted using a real-world cybersecurity system. This demonstration illustrates the practical implementation of a machine learning-based software solution in cybersecurity and highlights the potential challenges encountered during such implementations.

In recent years the technology field has grown exponentially, bringing with it new possibilities, but also new threats. This rapid advancement has created fertile grounds for new sophisticated cyber attacks, exhibiting a high degree of complexity. In an ever evolving cyber landscape, organizations need to dedicate valuable resources in enhancing their understanding of emergent threats for the purposes of identification, analysis and mitigation. To accomplish this task, they rely on Cyber Situation Awareness (CSA), a framework designed for the purposes of managing the virtual environment. This is achieved through the perception and comprehension of the behaviors therein, be that benign or malicious, followed by modeling the future state of the environment based on the gathered information. In this paper, we will discuss how exactly the theory of Situation Awareness has been applied to the cyber domain. Further on, we will present various techniques used for handling the large quantity of complex data and managing the dynamic nature of the environment by Cyber Situation Operation Centers (CSOC) and discuss in detail a number of methodologies that have been designed for the evaluation of the level of CSA. Finally, we will provide specific examples of simulated scenarios for the application of the CSA assessment techniques.

In the still growing field of cyber security, machine learning methods have largely been employed for detection tasks. Only a small portion revolves around offensive capabilities. Through the rise of Deep Reinforcement Learning, agents have also emerged with the goal of actively assessing the security of systems by the means of penetration testing. Thus learning the usage of different tools to emulate humans. In this paper we present an overview, and comparison of different autonomous penetration testing agents found within the literature. Various agents have been proposed, making use of distinct methods, but several factors such as modelling of the environment and scenarios, different algorithms, and the difference in chosen methods themselves, make it difficult to draw conclusions on the current state and performance of those agents. This comparison also lets us identify research challenges that present a major limiting factor, such as handling large action spaces, partial observability, defining the right reward structure, and learning in a real-world scenario.

In this paper, we present an approximate algorithm that is able to quickly modify a large distributed fc-nn graph by adding or removing nodes. The algorithm produces an approximate graph that is highly similar to the graph computed using a naïve approach, although it requires the computation of far fewer similarities. To achieve this goal, it relies on a novel, distributed graph based search procedure. All these algorithms are also experimentally evaluated, using both euclidean and non-euclidean datasets.

In this paper we present our new design of NNCTPH, a scalable algorithm to build an approximate k-NN graph from large text datasets. The algorithm uses a modified version of Context Triggered Piecewise Hashing to bin the input data into buckets, and uses NN-Descent, a versatile graph-building algorithm, inside each bucket. We use datasets consisting of the subject of spam emails to experimentally test the influence of the different parameters of the algorithm on the number of computed similarities, on processing time, and on the quality of the final graph. We also compare the algorithm with a sequential and a MapReduce implementation of NN-Descent. For our datasets, the algorithm proved to be up to ten times faster than NN-Descent, for the same quality of produced graph. Moreover, the speedup increased with the size of the dataset, making NNCTPH a sensible choice for very large text datasets.

In modern military operations, nations participate as members of a coalition. In order to realize a rapid command and control cycle, the armed forces of one nation need to establish communication links between their information system and that of other members of the coalition. These interconnections inevitably introduce risks, and these risks need to be managed. However, because each nation uses its own risk management methodology and tools, integrating the results of the risk assessment performed by a partner in the coalition with whom information is exchanged, into one's own risk management process, remains a periodically performed, manual operation. In this paper we will first discuss risk management approaches in a single organization, and show why it is important to adopt a continuous risk management approach. Next we will present a concept for realizing this continuous risk management in a coalition environment.