Can Artificial Intelligence Rescue Us from Hackers?

July 26, 2016 – Yesterday I wrote about the security vulnerability our present computers and servers have. On that same day an article appeared in The Christian Science Monitor entitled, “Machines v. hackers: Cybersecurity’s artificial intelligence future.” The author, Paul F. Roberts, writes: “Currently, humans are the ones who figure out how to respond to cyberattacks on networks, working to quickly block suspicious communications and analyze malicious behavior and software. But computers could perform the same functions — and do it much more quickly than people behind the keyboard.” The American Defense Advanced Research Projects Agency, or DARPA, agrees with this comment and sees artificial intelligence (AI) as a powerful weapon against intrusions into the most sensitive government computer systems. And DARPA has organized a Black Hat cybersecurity hacking competition next month in Las Vegas aimed at pitting humans against supercomputers to show how AI can identify and stop hacker exploits.

Hackers by their very nature are committed to out-thinking our machines. Their perception of AI is that it is just another form of software. States Eric S. Raymond, a developer of open source software, “No AI that presently exists can emulate even the most basic hacker skills.” He is of the opinion that AI lacks the skills needed: programming, an understanding of assembly language, debugging, reverse engineering, and researching. Jon Erickson, a security specialist and cryptologist in Northern California argues that these skills are what sets hackers apart. The question is can AI advance to the point that it can master these essentials.

Why are these important to cybersecurity?

1. Tight code can stop hackers from penetrating systems and tight programming is something AI systems are getting pretty good at doing. Today’s AIs can write code virtually indistinguishable from the best in human programmers. In the near future as they learn more about what hackers look for AI programmers should get even better than their human counterparts.
2. Writing and interpreting assembly language is a bit harder for AI because this is the language of the machine, the “0s” and “1s” that are inherent to the machine’s core, its CPU. Hackers have an advantage here that AI may never be able to overcome but that doesn’t mean machines cannot improve on the security of access to assembler code.
3. Debugging is something else that AI systems may be able to do as well as or better than their human counterparts. For hackers debugging is one of the easiest ways to penetrate a program. It involves finding program bugs and exploiting them. Better coding is the answer.
4. Reverse engineering on the other hand is probably much harder for an AI to do but another hacker’s delight. They can figure out what a program is supposed to do and thus expose back doors and other vulnerabilities. AI’s answer is to write unimpeachable code with no vulnerabilities, and, develop acuity to find the backdoors in code not written by AI.
5. Researching should be right up AIs bailiwick. Deep learning systems like IBM’s Watson can sift through data better than any human. But AI may not necessarily understand what a hacker seeks in doing research. And I’m not sure we want AI to develop that type of thinking.

In summation it appears likely that AI will or already has the ability to master three of the skill sets described above. All that’s needed is to get AI up to speed on the remaining two. But some in the cybersecurity business argue that AI will never replicate human ingenuity. Alex Rice, CTO of HackerOne, a cybersecurity firm, states, “The best hackers I know are driven by a strong conviction that absolutely anything is possible.” He believes no current AI has such conviction.

For the moment we know that the computers of the White House and U.S. State Department have been penetrated and hacked. We know from the revelations this week that the Democratic Party’s computer systems have also failed to stop the lifting of tens of thousands of private emails. A Panama law firm dealing with the offshore hiding of money saw its transactions lifted and displayed to the world. It remains a hacker’s heaven for the most part and we are still running behind. Now mobile computing is making hacking that much easier.

But the progress of AI in the last decade, and the development of quantum computing which is witnessing some significant breakthroughs of late should begin to push back against the bad guys. States Amit Mital, CTO at Symantec, AI is one of the “few beacons of hope in this mess.”