Read on Twitter
1/ Will AI replace pentesters?
Here's a thread from someone that studied AI for 3 years && worked in cybersecurity :)
Here's a thread from someone that studied AI for 3 years && worked in cybersecurity :)
2/ To start, we need to learn both AI & some pentesting. There are 3 main types of AI:
* Supervised
* Unsupervised
* Reinforcement Learning
Let's go over each one and see how/if it can change pentesting.
* Supervised
* Unsupervised
* Reinforcement Learning
Let's go over each one and see how/if it can change pentesting.
3/ Supervised learning is where we have labelled data and the machine learns to identify new data with these labels.
As an example, with the below data the machine would report "False" for False, True
As an example, with the below data the machine would report "False" for False, True
4/ We face 2 major problems with supervised learning:
* We need a lot of data (millions of data points with billions of features) for high accuracy
* We need the labels to be accurate
Making supervised AI is easy. The problem is the data.
* We need a lot of data (millions of data points with billions of features) for high accuracy
* We need the labels to be accurate
Making supervised AI is easy. The problem is the data.
5/ “Anyone can build an AI with 99.9% accuracy. The issue is building the dataset.” - IBM
But something important to note is that supervised learning is only for classification. That means it won’t be able to “hack” things as we imagined.
But something important to note is that supervised learning is only for classification. That means it won’t be able to “hack” things as we imagined.
6/ Our AI could learn what _might_ work given a portscan, but it could never truly "hack" something -- only aid hackers.
7/ Unsupervised Learning is where we have data, and the machine finds a pattern in that data.
For below data we might get back "Things that bark are dogs, but not all things with 4 legs are dogs"
For below data we might get back "Things that bark are dogs, but not all things with 4 legs are dogs"
8/ Unsupervised learning is great for finding the symptoms of a disease. Given a populous with many symptoms, what symptoms come from the disease?
9/ But like our last algorithm, it can't really hack. It may be able to say "exploits are typically done via XSS", but nothing a hacker won't already know.
Perhaps in network defences, it'd be able to identify common vulns.
Perhaps in network defences, it'd be able to identify common vulns.
10/ This brings us onto our final type of AI, the type I wrote about in my dissertation!
Reinforcement learning learns most like a child. In the worlds of Sutton & Barto:
Reinforcement learning learns most like a child. In the worlds of Sutton & Barto:
11/ "Of all the forms of machine learning, reinforcement learning is the closest to the kind of learning that humans and other animals do, and many of the core algorithms of reinforcement learning were originally inspired by biological learning systems." - Sutton & Barto
12/ It learns via reinforcement.
We perform an action (take our the rubbish) on our environment (the rubbish bin). This returns a reward (our mum gives us sweets and a “thank you”) and a state (we are now cold, outside by our bins).
We perform an action (take our the rubbish) on our environment (the rubbish bin). This returns a reward (our mum gives us sweets and a “thank you”) and a state (we are now cold, outside by our bins).
13/ Reinforcement agents learn the same way as humans do.
I believe reinforcement agents can learn to become pentesters.
I believe reinforcement agents can learn to become pentesters.
14/ This is because they can be:
* Creative
* Smart
* Very fast
* Learn from other great hackers
* Teaches itself new skills
This documentary is great for learning about the capabilities:
* Creative
* Smart
* Very fast
* Learn from other great hackers
* Teaches itself new skills
This documentary is great for learning about the capabilities:
15/ There are 2 ways it can learn.
It can watch other great hackers and learn commands, techniques, rules of the engagement.
But this makes it hack like a human, and humans suck. We make mistakes, we're not accurate.
It can watch other great hackers and learn commands, techniques, rules of the engagement.
But this makes it hack like a human, and humans suck. We make mistakes, we're not accurate.
16/ The other way is for it to teach itself. We'd need to tell it some basic rules "No DoS, no publishing customer information" and it could learn.
But it's much harder, and will take much longer to learn how to hack this way.
But it's much harder, and will take much longer to learn how to hack this way.
17/ TL;DR AI could replace pentesters in the distant future using reinforcement learning, but the amount of data needed is so much we do not need to worry for another ~20 years.
18/ Even then, AI will most likely work with humans, not replace us like Gary Kasparov says in Deep Thinking. https://www.goodreads.com/book/show/31934455-deep-thinking
19/ I wrote much more in-depth about this on my blog, check it out if you want to know more :) https://skerritt.blog/ai-pentesting/
