Editing AI for Cybersecurity (section)

== <span style="color: #FFFFFF;">Applying</span> ==
'''Network intrusion detection with scikit-learn:'''
<syntaxhighlight lang="python">
import pandas as pd
import numpy as np
from sklearn.ensemble import IsolationForest, RandomForestClassifier
from sklearn.preprocessing import StandardScaler
from sklearn.metrics import classification_report

# Load network flow data (e.g., KDD Cup 99, CICIDS-2017)
df = pd.read_csv("network_flows.csv")
features = ['duration', 'protocol_type', 'bytes_sent', 'bytes_recv',
            'num_connections', 'flag', 'land', 'wrong_fragment']
X = pd.get_dummies(df[features])  # One-hot encode categoricals
y = (df['label'] != 'normal').astype(int)  # Binary: 0=normal, 1=attack

scaler = StandardScaler()
X_scaled = scaler.fit_transform(X)

# Anomaly detection (unsupervised) for zero-day detection
iso_forest = IsolationForest(contamination=0.01, n_estimators=200, random_state=42)
anomaly_scores = iso_forest.fit_predict(X_scaled)  # -1 = anomaly

# Supervised classification for known attack types
clf = RandomForestClassifier(n_estimators=200, class_weight='balanced')
clf.fit(X_scaled, y)
print(classification_report(y, clf.predict(X_scaled)))

# Real-time scoring for production
def score_flow(flow_dict):
    flow_df = pd.DataFrame([flow_dict])
    flow_processed = pd.get_dummies(flow_df).reindex(columns=X.columns, fill_value=0)
    flow_scaled = scaler.transform(flow_processed)
    prob = clf.predict_proba(flow_scaled)[0][1]
    anomaly = iso_forest.predict(flow_scaled)[0]
    return {'attack_probability': prob, 'anomaly': anomaly == -1}
</syntaxhighlight>

; AI in cybersecurity application map
: '''Malware detection''' → Static: PE header features + GBM; Dynamic: behavioral sandbox + LSTM
: '''Network IDS''' → Isolation Forest (anomaly), Random Forest/XGBoost (signature)
: '''Email phishing''' → BERT fine-tuned on email headers/body, URL features
: '''UEBA (insider threats)''' → Autoencoder or LSTM on user action sequences
: '''Vulnerability triage''' → GNN on code dependency graphs, LLM for advisory parsing
: '''Threat intelligence''' → LLM extraction from threat reports; named entity recognition
</div>

<div style="background-color: #8B4500; color: #FFFFFF; padding: 20px; border-radius: 8px; margin-bottom: 15px;">