Charter of Trust » What is an AI-Powered SOC and why does it matter?

By Vinod Vasudevan, Global CTO MDR & Deputy Global CTO – Cybersecurity Services, Atos

The blind spot

The key challenge that SOCs have today is detecting advanced attacks early and responding rapidly. Advanced attacks use newer techniques or significant variation of an existing one,hence these attacks cannot be detected using previously known signatures. Similarly, threat actors are getting better at camouflaging or launching attacks from compromised systems of a legitimate organization. This defeats threat intelligence-based detection using IoCs including IP/ULR/email IDs/ Usernames. There is a blind spot for conventional security technologies where it is an unknown attack and an unknown threat actor.

The value of AI for detection of blind spots

AI can throw light on this blind spot and enable detection. AI can do this by profiling known good behavior and detecting deviations from these baselines. As an example, using AI we can profile a normal/admin user for systems of allowed access, data size, time of access (time of day, week). An attacker who compromises this user will show different access patterns that can be detected as an anomaly using AI algorithms. Such profiling can be used to detect lateral movement, data exfiltration. AI can also be used to learn from known malicious behavior when enough data samples are available. This is true for detection of malware binaries. Deep learning algorithms can be used to learn from millions of malware samples available to detect malware even if new or hitherto unknown malware.

More effective response capabilities and interconnected SOCs

As we step into the future, AI algorithms can also be used to learn successful response mechanisms used to contain & orchestrate a successful ransomware response. This will lead to autonomous response that can trigger response steps in real time to contain major attacks and ensure that business impact is reduced. AI can also give much better results as we create, interconnect and strengthen national and regional Security Operation Centers (SOCs) of critical infrastructure or functions at national and EU level. Interconnected SOCs can provide more data for AI algorithms to learn from and learning can be transferred across SOCs to democratize the detection and response capabilities.

AI is key to face an ever-evolving threat landscape

Cyber crime syndicates have already started using AI for launching targeted attacks. The use of AI makes it easy to launch personalized attacks at scale. This also means that we cannot depend only on rule based approach to counter AI driven attacks. We cannot afford armies of highly scarce Cyber Security professionals to staff SOCs. The use of AI in SOC will enable automation of human actions, emulate human intelligence in analysis/response and enable the scale required for successful response to such AI driven attacks.

The future is towards using AI for tactical scale in combination with Human Intelligence for strategic actions for combating the ever-evolving complex threat landscape.