[Music]
[Applause]
[Music]
hello
good morning uh good afternoon depending
on where you are i'm patrick tucker
technology editor at defense one joining
me today
is richard marco ceo of eset
uh fantastic company we're going to talk
today about
applications of artificial intelligence
and cyber security both the good and the
bad and uh this is a vitally important
topic
because if you are like me or you've
been awake for the last few years you
know that uh
we're all beset all the time by very
aggressive marketing about
what artificial intelligence can do for
businesses what it can perhaps do for
individuals
uh we don't hear a lot about how it
might cause havoc
unless you're watching science fiction
movies so there's this strange
divergence right in terms of the
marketing that we consume and the the
content that we consume
where on the one hand we're being told
all of the great things that ai
do for us we're always set all the time
scared through uh
hyperbole and and and fiction
uh about what it might do uh when it's
unleashed but uh richard here you
actually operate at the center of where
those two worlds collide creating cyber
security solutions through artificial
intelligence and also watching
uh how potential adversaries might use
the most important emerging technology
of the 21st century to cause problems
and wreak havoc
so first i wonder if you can tell us
anything about
whether you've seen actual examples
today
of artificial intelligence whether
machine learning
or something more complex like neural
networks used as part
of a cyber security attack is this
something that exists right now
perhaps right so um
it's it's definitely a field that is
attracting a lot of attention and
everybody
is like feeling you know you you said it
very correctly
there is quite a bit of hype behind it
some artificial intelligence so
uh in many cases people just imagine
that there is some
independent intelligence working in the
background
and in this case producing some
malicious
attack software and so on
what in general you can't
easily tell whether whether machine
learning or artificial intelligence was
used in
a particular attack unless you you have
a
like a clear evidence so you might see
signs of it
but unless you confiscate servers and
you see that they were using the
attackers for using the machine learning
or artificial intelligence in general
you you can't have a proof
but among the things that we consider
are probably influenced by or
might be using artificial intelligence
are things like
for example uh the spam can
uh campaigns you know you need to
produce a text that is
that looks like it's coming from a human
being that is easily readable
he's able to persuade people to do
something
it's written in different languages and
this is where
artificial intelligence as an example
can play a very
uh very important role in the past like
let's say
five to ten years ago we saw many
examples where you saw this kind of
phishing email coming to you and he knew
right from the beginning that
it's a mess it was just words you know
in wrong orders and
so on right now it's a lot better and
it's only improving
huh okay so this is to your mind
something that we're actually already
experiencing we're already experiencing
applications of artificial intelligence
in cyber attacks
um tell us a little bit about the state
of the art of
artificial intelligence in defending
from not only those attacks but really
all of them
uh i know from my coverage of this area
that one of the things ai does
is rapidly accelerate the pace of
operations
and defending against potential cyber
attackers
is something that you have to do very
promptly and in many ways almost
predictively
so what is the current state of the art
of using ai and cyber defense what does
that look like right now
so the machine learning of
like the current version deep learning
is especially powerful when you when you
are able to process you want to process
some
big data you have a lot of like data
that has some
it contains some patterns that can be
classified so let's say
malicious non-malicious so if you have
that
then you can use these machine learning
algorithms
to train your module as it is called
to be able to distinguish it but you
need to be careful
on what you put as an input into it if
you
if you are too general you expect too
much from it
then the results might be just
disappointing so in our case and i
i believe we are at the edge of using
machine learning in
in malicious software kind of protection
is that we use several kind of
algorithms they're not machine learning
in pre-processing inputs
into the then models
that use deep learning to to do the
final decisions and usually we use
several of such models for different
scenarios
so do you envision uh based on what
you've seen
that artificial intelligence is going to
accelerate both the pace of cyber
attacks
and the pace of necessary defense so it
becomes almost
like an arms race if you will is that
the future that we're headed towards
uh i would say so because uh the example
i
i gave about the fishing emails it's
just
the the part you know it's generally
accepted that the human beings are
usually
the weakest point in in the defense so
if you are able to trick the right
people then you are able to penetrate
the overall defense quite well usually
so
uh this artificial intelligence is
exactly going in the direction to be
able to
interact with human beings in a way that
they don't
realize this is uh artificial
intelligence in the background or
they don't realize they are being
manipulated
into doing some steps so yeah it's it is
going to accelerate this and make it
more
tricky and can you describe for us very
quickly
in this accelerated future what is the
role for
classically trained cybersecurity
professionals it's it's something of an
art
as well as the science you have to learn
a lot about
the psychology that attackers might use
in developing phishing emails like this
and you you have to understand different
methodologies that different attackers
have used it requires a lot of
experience to become really good at this
and the best practitioners in cyber
security
uh have very deep uh experience with
specific attackers so
what is the role of professionals like
that
in a future where this tool is very
widely available
so uh we we need to realize that uh
even these so-called deep
like networks so they contain a number
of layers
number of neurons they are far far from
what
the human brain is like the capacity of
human brain so usually the
the artificial intelligence is still
very much dependent on
human intelligence to kind of direct it
to train it in the right way
what is artificial intelligence better
than human
is uh the ability to use
you know these i t tools like a lot of
memory a lot of informations
and process it quickly so human being is
just not able to do this
in the same way so this is where i see
uh
this connection you have the you you
create your models your
neural networks they are able to process
a lot of information
based on what what you train them for
you know like
identifying animal anomalies in a
network of you know traffic or whatever
it is
because you can't do it like human being
can't do that
but yeah messy you know a neural network
can
yeah uh and this is i think also an
important point because we talk a little
bit about machine learning and you also
talk about neural networks and there's
there's something of a difference
between the machine learning is uh the
application of somewhat conventional
statistical methods
uh to a problem using big data in very
large compute
and neural network methodology relies on
somewhat more abstract and complex
algorithms
and the process by which a neural
network
reaches its conclusion or reaches its
output
is often very mysterious to the operator
it's difficult to understand
and i know from writing about this space
that policy makers
and people that have to be accountable
to
elected electors and at voters
they are sometimes very hesitant to
employ
neural networks precisely because they
have difficulty
describing the process by which that
uh neural network reached the conclusion
that it did
how do you tell a voter that a neural
network decided that uh
they were suspicious and deserved extra
security check like it's it's a very
inconvenient conversation
so where are we right now in terms of
taking neural networks
and making them more explainable to
uh the public and to operators or is
that not something that's actually
possible
uh given the nature of that tool
yes that's that's a very very good kind
of indication that
it's in my opinion the nature of of this
technology the neural networks that it's
it's kind of universal tool to
uh to work with data and and uh
to be able to make some decisions and
you have some universal
universal algorithm how you train this
these networks
but then it's usually very difficult to
know exactly why they do the decisions
that they do and what is being more and
more uncovered
and shown is that while there are those
fancy examples of
neural networks doing almost magic then
uh it's quite often very easy to fool
them to make completely wrong decisions
for things that for human beings are
obvious you know because we
just don't see all the all the
vulnerabilities of the design
so and this speaks to a growing area of
research and study which is
safety in artificial intelligence uh
it's
something that's becoming more and more
important especially as governments and
militaries begin to adopt artificial
intelligence solutions on top of
businesses it's one thing if you're
if your algorithm outputs you a wrong
suggestion for showing an ad to somebody
it's very different if your output
sends you wrong targeting information
for a military operation that's very
bad generally speaking so
when you look at the resources that are
required to really
run a good artificial intelligence
program
and there are are three you need a lot
of data
uh you need a lot of compute power which
is today available through
uh enterprise compute solutions like
azure from microsoft aws
all sorts i don't have any connection to
them and you need these statistical
algorithms when you look at those
resources
do you see a future where attackers
even very low level criminal groups will
potentially have
access to them in the same way as
large institutions as governments and as
entities that are
bound to defend are those resources
becoming more available
well i i would say that you know there's
simply a lot of
money in in cyber crime and you have all
the different
like groups you know some some are
really just pure uh
criminals looking for some financial
gains but we know that there is
state-sponsored you know cyber uh thing
going on so
i i think there is already enough money
to use whatever
tools that are available if we go down
to low-level criminals as you indicated
i i would say even right now the
the ability to design your own uh
you know neural networks and to use it
to process your own set of data is
available basically to anybody already
right now
and i think this availability will be
even bigger and so it will be more and
more easy to
design more and more complex networks
and use all the
results of the research that is going on
all the time so yes
from this perspective definitely is but
to be able to
correctly use or efficiently use this
technology for your for your means
is is a different thing it's not so
obvious it's not so
it as i say it's it's not intelligence
by itself it's not working on its own
you know
you need to employ it yeah and
to your mind legislative efforts
regulations
like gdpr like different regulation
regimes
that apply specifically to data and
often
personal or private data do you see
those as having a positive or negative
effect
on this threat that you mentioned it
obviously makes it a little bit more
complicated to run
a legitimate business because data is
harder to come by because of gdpr
but does it also decrease the threat
what is your opinion
so i i noticed there there is a draft of
what is called i think
artificial intelligence act that is
being
uh created by european union
european commissioner and it really
tries to address the
some of the known concerns like for
example
uh using uh artificial intelligence to
kind of score how people behave if you
cross the street
with the red light and these kind of
things and and it explicitly says like
this is prohibited this is not allowed
way of using this
and it goes to many different areas and
actually sounds quite
reasonable to me but when we talk about
cyber crime of course they are not
limited by by legislation so it's more
about
uh probably the leadership the
government's not misusing
machine learning in areas where it
already can do some harm
there's a couple of questions that we've
got and i'd like to ask the first one
this is an area that i'm very interested
in i think that uh anybody that
lives in eastern europe and is very
concerned about
russian misinformation efforts should
also be
interested in how does disinformation
come into the future of ai
is it a threat to its future development
so a little bit on
disinformation and uh
influence campaigns and the role of
artificial intelligence in those in the
future
right i i guess this is unfortunately
the space where
where artificial intelligence even even
with
the current state is able to
to help like to do to do harm so
uh you
what body what the artificial
intelligence is able to do is to
use the you know the existing text the
existing
information available on the internet
and then to combine to produce new text
and the text might even look like
reasonable but they might be
false they might be not based on any
real um
evidence or whatever then we have this
uh
relatively well known like deep deep
fake you know this fake videos
right that are already quite good and
will only be better in the future so
so like it really can be helped to
to create chaos to to make it very
difficult to distinguish reality from
from like just whatever
do you see a role of ai in helping
attackers determine which individuals
might be most susceptible to
disinformation
as well as what messages they might be
vulnerable to is that also a role for ai
uh sure because i i think we already see
it with uh
being used in in uh commercial practice
you know like
youtube and so on you you get you know
the recommendations for your next videos
and uh
probably all of us whoever used it we
see that it actually works well so
the these algorithms are able to kind of
identify the bubbles
like these these pieces that make
people believe that this is something
they want to read or they are interested
in that and so then you can couple it
with whatever
misinformation you want and probably the
uh the impact will be
significant yeah so i think this is a
really important point because if you
watched
russian disinformation campaigns aimed
at the u.s electorate in 2016 for
example
what you saw was an expert use
of what is given away information to
social media outlets
like facebook information that we all
give away basically all the time whether
we kind of realize it or not even if
we're not on those networks
uh currently that used in order to
deliver very specific people very
deliverance and
information messages and the
accelerating effect of ai just means a
lot more of that so that is the
i think highlights the importance of
potential regulation and on regulation
very good question from tyson barker
what do you think of the explainability
requirement
in the draft ai regulation
um so
um just please try to explain i
uh yeah so the draft ai regulation
uh right explain ability okay i see
right
um so
you know you you like know you compared
artificial intelligence to the
statistical
kind of models and methods and yes with
statistical
models we usually you can usually tell
like
why the model is doing what what it is
doing with artificial intelligence is
not
uh usually not possible at all so
probably
like trying to to be able to
to tell like why it works the way it
works is going to be difficult
but you can do some countermeasures to
ensure higher safety so
a very simple one or very general is
just human supervised on
critical like decisions you know that
it's because
human being has this ability to
distinguish obvious
wrongness from uh
from reasonable recommendation
i think that this speaks a little bit to
some of the efforts that we've seen
uh by militaries particularly the us
military
to employ artificial intelligence in a
way that keeps human beings accountable
i don't know if you're
familiar with it but uh the u.s military
has adopted a long list
of ethical principles that they'll use
when applying ai to their operations
uh hopefully uh it's very good that they
adopted the the list
whether or not it's employed as
prescribed that becomes something that
individual commanders will make
decisions about
uh but to your mind have you seen any of
the lists
coming out of google coming out of
microsoft coming out of other
big silicon valley players lists of
ethical principles
that apply to the use of artificial
intelligence
and and what do you think of them are
they sufficient or do they not go far
enough
uh well i i didn't study this in detail
i noticed this is a kind of regular kind
of input so
i you know you can you can stay on a
quite general level and
on that level it would just sound good
you simply don't want to have
artificial intelligence being used
against humans
misuse you know their weaknesses
against them but then what it means in
practice is
more tricky because we you gave an
example facebook
but we know that for facebook is like
from a commercial perspective is
is kind of helping them if if you know
when people
are getting into you know fights and
arguing about uh their point of views
and
bubbles clashing and so on and so
you know like balancing these
ethical aspects with uh with the pure
business
that's that's a tricky thing yeah uh
very interesting
research paper out quite uh recently
that
looks at viral tweets viral social
messages and the ones that go most viral
tend to be the ones that uh
state an angry political opinion believe
it or not
so uh you can imagine that being
weaponized
uh and automated and as as you say
accelerated
and scaled up to the point where human
beings can't uh
properly control or defend the onslaught
of that
uh new messaging and then that makes
virality in
uh in internet context almost irrelevant
uh just destroying the joy of social
media for everyone
if you had any uh very good question
here
from uh dr vera robiscrinka
russia and china are investing in cyber
capabilities
how do you see a role of the eu in
tackling potential future
superiority in the cyber domain so
russia and china are also investing a
lot in artificial intelligence
uh they both have cyber operations
offensive
uh and of course have constructed
elaborate cyber defensive
measures as well what is the role of the
eu
in helping democratic nation states
better compete in that area
right so i i guess the
uh the focus uh already moved from
from fighting and battles like a
physical
uh to more like virtual right
and so it's it's logical that there is
uh
quite a bit of investment in this from
all the super powers
now the eu just needs to
decide what uh what role
they want to what we want to we want to
have
i would we know the statistics the
statistics are saying the investment
to cyber security in general in startups
like 90 percent goes to u.s and let's
say uh
israel for example so it's just a tiny
portion that is left for the rest
so i i would suppose that
we we already see that the cyber
security is becoming more uh
kind of china is closing what what kind
of
technologies are allowed to be used by
chinese
uh organizations or institutions we see
this in other parts of the world russia
for example
so probably european union also needs to
ensure that we that there is enough uh
research and development going on within
european union
in this space whether it's cyber
security in general or machine learning
artificial intelligence
um like a field of itself yeah so
so i think like recognizing or
identifying the
what we already have and how to boost it
further so that we are not dependent
on the technologies being being imported
from abroad
okay uh so a uh a final note
a a endorsement for the importance of
alliances and the
uh endorsement for the importance of
individual individual and independent
research dollars in this very important
field
uh that is all the time we have for this
session i want to thank you and remind
you all please stay here
there's a session on 5g coming up uh
right now
but thank you very much please join me
in thanking my guests
[Music]
[Applause]
[Music]
you