How AI can help businesses thwart cyberattacks

Artificial intelligence (AI) has many applications across multiple aspects of our lives – from our phones to our social media accounts. It is also increasingly being used in business across many sectors and industries.

Companies are using AI tools to automate or optimise many tasks throughout the business such as those that require split-second decisions, such as fraud analysis or identification verification, or to manage sensitive information on the company’s network.

The increased use of AI comes with increased risk, and data breaches of major corporations have become more commonplace – and are often newsworthy – such as the HSE hack. With just under half of Irish businesses suffering a cyberattack in the last 12 months and cyberattacks increasing 26 per cent year on year, according to a recent Hiscox report, it’s clear that cybersecurity also needs to increase.

These attacks come at no small price with 25 per cent of Irish businesses paying five times or more to recover data, with the lowest ransom payments estimated to be €12,600 with €9,900 in recovery costs. The largest ransom paid in Ireland in 2021 was €42,693, and the median cost is over €15,300. The rise of people working from home has also increased the risk with more than 60 per cent of respondents believing their business is more vulnerable as a result.

Mark Jordan, chief strategy officer, Skillnet Ireland, says that companies are worried that employee behaviours are putting them at risk, especially given the low level of cybersecurity maturity in Ireland – especially within SMEs. “There has traditionally been a low level of investment in both mitigation actions and skills development. However, there is a growing awareness of the need for greater investment.”

Luckily, AI can also be used to help against cyberattacks as well as other cyber threats.

How vulnerable are businesses to a cyber attack? Cybersecurity means protecting computer systems and networks from unauthorised access, says Tri Kurniawan Wijaya, AI lead at Huawei Ireland Research Center. “This unauthorised access would further result in information and identity theft or system disruption.”

The more businesses are connected to the internet, the more vulnerable they become. “Additionally, on the one hand, the bigger the business the more threats it received. This is because bigger businesses attract a larger number of attackers with more varied motives. On the other hand, the bigger the business the more power it has to defend itself. Thus it depends on how effective the business is in defending itself relative to its size.”

In other sectors when a newsworthy event happens it is usually a good thing, e.g., something new is found, built, or constructed, says Wijaya. “On the contrary, if something major happens in cybersecurity usually it is a bad thing, e.g., a major hack or breach.”

How does AI help businesses? AI enables us to process a huge amount of data, way more than a human analysts can do, says Wijaya. “This is something that we could not do previously. From this amount of data we can train AI to help us with our defence.

“For example, to counter the more standard or regular attacks we can train AI using the information gathered from past attacks to automatically sweep the networks and systems and see whether there are irregularities.”

This solution, however, might not prevent future attacks that shared no similarity with past attacks, he says. “To solve this problem we can pair an AI with a human analyst; we train an AI to recognise what a regular system looks like. Then for something that AI is unsure of it passes the data to the human analyst to investigate.

“AI can help automatically filter out cases that it is sure are a threat (to be closed down or quarantined) or it believes to be regular (nothing to be done), or if it is unsure it can pass these cases to the human analysts.”

While it may seem counter-intuitive to need a human analyst, Wijaya says that even if the AI tool still needs human analysts to investigate the grey area it is already a huge help because the analysts do not need to shift through a humongous amount of system logs recording or monitoring charts.