AI: Security

AI-assisted threat detection (AI for security operations)

Miro Kosut

Miro Kosut

— 2 min read
Share

Note: Adjacent scope

This is AI used as a defensive tool, distinct from securing the AI fabric (Securing the high-performance fabric). It maps to the blueprint's "protection against malicious uses" and to Core zero-trust policy-building with AI/ML - a common exam-adjacent AI use case.

The idea

A vulnerability is a weakness; a threat exploits it. Signature/rule-based defences produce high false positives and miss novel attacks; ML learns normal behaviour and flags deviations, adapting in real time. Three use cases:

  • Malware detection - ML scores file behaviour against large benign/malicious datasets, blocking and reporting suspicious files (e.g. Cisco Secure Endpoint); AI-assisted deep packet inspection can alert/block/reroute in flight.
  • Phishing detection - NLP reads email content/context, sender reputation, and URL structure to grade maliciousness and catch sophisticated BEC (e.g. Cisco Secure Email).
  • AI-enhanced IPS - learns a behavioural baseline from network telemetry and flags anomalies (unusual transfers/access), even spotting malware in encrypted traffic without decryption by behaviour, correlating with global threat intel (e.g. Cisco Secure Network Analytics).

Beyond detection: the response lifecycle

The same behavioural ML extends past detection into incident response. Against an advanced persistent threat (APT) - an intruder who lingers quietly, exfiltrating IP or data over months - AI supports proactive threat hunting, scanning for atypical logins, data transfers, and access patterns that signal a breach before obvious damage. Once a breach is confirmed, AI assists detection -> assessment -> response: real-time correlation across affected systems, root-cause and scope analysis, and partially automated containment/eradication - isolating hosts, blocking addresses, or pushing patches - which shortens response time and limits spread. It also automates incident documentation (NLP over log data to produce event timelines, impacted systems, and audit-ready reports). As with closed-loop AIOps (AI-assisted operations - AIOps), the high-blast-radius response actions stay human-gated; AI accelerates the loop rather than owning it.

Why it matters for design

Behaviour-based detection reduces false positives versus static signatures and scales to traffic volumes humans can't review - the same telemetry-and-ML pattern behind AI-assisted operations - AIOps. In an AI data centre it complements fabric protection and the AI security policy (Regulations, governance, and AI security policy): the network feeds telemetry; ML turns it into detections.

Recommendation / justification

Use AI-assisted detection to augment, not replace, layered controls: it earns its place where signatures fail (novel malware, BEC, encrypted-traffic threats) and where alert volume overwhelms analysts. Justify by detection coverage and false-positive reduction; keep humans in the loop for response.

IPv6 / dual-stack note

Behavioural baselines and flow analytics must cover IPv4 and IPv6 equally, or IPv6 becomes a blind spot.

Spaced repetition

How does ML-based threat detection improve on signature/rule-based defence?

It learns a behavioural baseline and flags deviations, adapting in real time - cutting false positives and catching novel attacks (including malware in encrypted traffic by behaviour, without decryption).

The three AI-assisted threat-detection use cases?

Malware detection (ML file-behaviour scoring + AI-assisted DPI), phishing detection (NLP on content/sender/URL, catches BEC), and AI-enhanced IPS (behavioural anomaly detection on network telemetry).

What is an advanced persistent threat (APT), and how does AI help across the response lifecycle?

An APT is an intruder who lingers quietly, exfiltrating data/IP over a long period. AI supports proactive threat hunting (atypical logins/transfers), real-time correlation and root-cause/scope analysis, gated automated containment (isolate hosts, block IPs, patch), and NLP-generated incident documentation - with high-blast-radius actions kept human-gated.

Sources

  • Cisco U. AI Use Cases - Threat Detection (Cisco Secure Endpoint, Secure Email, Secure Network Analytics).
  • Cisco U. AI Use Cases - Incident Response (APT, proactive threat hunting, automated containment, reporting).

domain: AI Infrastructure · type: design-note · status: complete · tags: · source: Cisco U. - AI Use Cases (Threat Detection)

Read more