The large majority of the current cybersecurity technologies are identifying cyberattacks based on predefined signatures, rules, filters or scenarios such as virus or malware definitions, firewall rules, intrusion prevention filters or SIEM playbooks. In recent years, these technologies have achieved only a small reach towards addressing the new challenges and the pace of their development is bowing in front of the much faster evolution of the threats. This exponential increase in the number and complexity of cyberattacks opened the door to the utilization of artificial intelligence algorithms within the protection technologies primarily for a couple of reasons: to identify deviations from trained regular behavior and to analyze large volumes of data for patterns. Following this cycle, in turn, cyberattacks started themselves to employ artificial intelligence to automate labor-intensive tasks like social media and other public information analysis to prioritize targets, to evade current techniques, to generate domains or to perform human-like operations. These new trends started to challenge the current static-rule-based approach largely used today in the cybersecurity ecosystem and at the same time to provide the opportunity to adapt the current technologies and sharing platforms to respond to these dynamic threats. The learning processes needs modifications as well by employing mechanisms that will allow to deliver knowledge faster and more specialized. These developments in the cybersecurity realm led not only to the adaptation of the existing technologies but also to the creation of new trends, new technologies and new products that could offer alternative protection against this fast changing threat landscape.

cybersecurity; artificial intelligence; machine learning; siem.