The Role of Machine Learning in Cybersecurity

TLDR

Machine learning is a transformative technology widely adopted across domains, yet its application in cybersecurity remains nascent, creating a gap between research and practice that hinders full exploitation of its benefits. This article offers a comprehensive overview of machine learning’s role in cybersecurity, aiming to inform readers and guide future development. The authors review ML’s advantages over human detection, identify deployment challenges, outline stakeholder contributions, and illustrate practical impact through two industrial case studies.

Abstract

Machine Learning (ML) represents a pivotal technology for current and future information systems, and many domains already leverage the capabilities of ML. However, deployment of ML in cybersecurity is still at an early stage, revealing a significant discrepancy between research and practice. Such a discrepancy has its root cause in the current state of the art, which does not allow us to identify the role of ML in cybersecurity. The full potential of ML will never be unleashed unless its pros and cons are understood by a broad audience. This article is the first attempt to provide a holistic understanding of the role of ML in the entire cybersecurity domain—to any potential reader with an interest in this topic. We highlight the advantages of ML with respect to human-driven detection methods, as well as the additional tasks that can be addressed by ML in cybersecurity. Moreover, we elucidate various intrinsic problems affecting real ML deployments in cybersecurity. Finally, we present how various stakeholders can contribute to future developments of ML in cybersecurity, which is essential for further progress in this field. Our contributions are complemented with two real case studies describing industrial applications of ML as defense against cyber-threats.