Machine learning in cybersecurity

Expert rules in SIEM systems help track suspicious behavior. However, many attack scenarios cannot be described or detected this way. ML models handle this task effectively.

The BAD (Behavioral Anomaly Detection) module in MaxPatrol SIEM acts as a "second-opinion" system that improves attack detection effectiveness through alternative event analysis methods and by assessing each trigger’s reliability on a 100-point scale. BAD also independently detects targeted attacks, serving as a second layer of defense.

The 49 ML models are divided into several types and subtypes:

• Process activity
• Process execution activity
• Network process activity
• Process access to local pipes
• Relationships between processes on different hosts
• Access activity
• Network share access
• Network pipe access

The BAD module incorporates ML model verdicts and correlation rules, enabling security teams to make prompt and accurate decisions when analyzing triggers.

In MaxPatrol SIEM, the BAD module:

• Independently detects targeted attacks and previously unknown anomalies.
• Collects event and user data, assigns risk scores, and provides alternative assessments based on its algorithms.
• Helps analysts make faster security decisions.
• Enables rapid detection of previously unknown threats that are invisible in fragmented data streams.
   

In PT NAD, machine learning helps:

• Detect anomalous node activity using profiling rules.
• Identify applications hiding from network traffic analysis systems.

User profiling rules (UPR)

UPRs allow you to configure filters and monitor the behavior of network participants within the traffic of interest. Machine learning identifies anomalies in traffic and automates the decision-making process for identifying malicious activity. You can create your own filters or use baseline rules developed in collaboration with the PT Expert Security Center (PT ESC).

In each filter, you can specify a single feature (such as the number of bytes sent or unique connections), group data by object (client, server, or client-server pair), or select data for the entire network, as well as define a time interval. An anomaly is defined as exceeding a specific threshold in one or multiple time series. The ML model has three sensitivity levels (low, medium, and high) and can trigger on both minor and significant deviations.

The ML model in PT Sandbox performs part of the behavioral analysis of files. Dynamic analysis involves running files in a virtual environment, logging their behavior, and analyzing the resulting log. Each running process leaves behind a sequence of system calls (a trace) through which it interacts with the operating system. The ML team at Positive Technologies has analyzed numerous malicious and clean traces to identify sequences characteristic of malware, including network requests to the internet, file operations, and registry accesses. These calls are reduced to a final feature vector that is processed by the ML model, which then classifies the behavior as "bad" or "good."

To implement these ML models in the product, a specific technology stack is used: PT Sandbox utilizes Python code, the ML model is serialized using ONNX, and MLflow is used for experiment tracking and as an artifact repository. Additionally, the model is trained on a daily stream of examples and a reference dataset that excludes false positives, delivering highly accurate detection results.

Tasks the ML model in PT Sandbox helps handle:

• Detecting anomalous subprocess chains. A large number of branching sequences is legitimate on its own. However, the number of nodes, nesting depth, and the repetition or uniqueness of process names can only be effectively analyzed by the ML model.
• Detecting non-standard values of call parameters. In most cases, analysts focus on significant function parameters when searching for malware. The ML model effectively analyzes the remaining parameters.
• Investigating atypical sequences of function calls. Sometimes individual functions or combinations of functions may appear benign, but their sequence is not found in legitimate software. An analyst would need extensive experience to notice such a pattern manually. The ML model detects these patterns through classification using features that were not predefined as indicators of maliciousness.

The main task of ML in PT Sandbox is to continuously improve the accuracy of verdicts when determining if an object is malicious. By analyzing over 8,500 features of object behavior, the ML model ensures high detection quality that is unattainable for systems that use standard malware detection methods.

Assessing the trending potential of vulnerabilities (CVEs) based on the number of mentions in databases (a statistical approach) has a significant drawback: there is a risk that a vulnerability will be recognized as trending only when it is already being actively exploited.

The machine learning approach includes the following stages:

• The database of publications about CVEs is updated regularly.
• Once a day, the model computes predictions for vulnerabilities based on a dozen parameters, including publication time, number of comments, reposts, likes, post text, and reactions.
• The top 20 predicted CVEs are sent to experts for analysis.

The ML model is trained on both textual (post content) and quantitative features (such as number of subscribers, reactions, and vulnerability mentions) and predicts trending vulnerabilities before the number of their mentions exceeds a threshold value. Experts provide the final evaluation of the model’s performance using quality metrics.

Using the ML model in MaxPatrol VM allows experts to efficiently and promptly determine which CVEs require attention and to rapidly deliver information about trending vulnerabilities into the product.

Products that analyze HTTP traffic receive a large volume of payloads, which may include command shells for remote web server management. In PT Application Firewall, ML models that detect web shells separate legitimate data from malicious data. One model prevents illegitimate scripts from loading, while another detects web shell activity. These models are trained using data on web shells from open sources and examples encountered during Standoff cyberbattles. This diversity increases detection coverage and makes it possible to detect new web shells that cannot be identified using a rule-based approach.

To evaluate detection accuracy, the system uses holdout sets prepared by experts. The initial quality assessment occurs during CI/CD. After model training, a continuous machine learning (CML) process is launched, allowing developers to see the difference in model performance on holdout data within a merge request.

What tasks does ML perform in PT Application Firewall?

• Detecting malicious shells in requests and responses. The ML model determines the probability that a downloaded file is malicious by comparing it with a threshold value. The system uses a convolutional neural network (CNN) model is for classification.
• Detecting shellcode generated by the Metasploit Framework in various formats and encodings.
• The models are trained using payloads created with the Metasploit Framework and data from the Microsoft Malware Prediction competition.

PT Naira, an AI assistant within PT Application Inspector, automates vulnerability triage across application source code and components. Triage involves the initial processing and classification of analyzer alerts. Investigating false positives typically consumes most of the time in secure development.

On average, a single AppSec engineer supports around 500 developers, with thousands of potential vulnerabilities piling up each week. Analyzing these alerts can take up to 90% of an engineer's time. Furthermore, these professionals must fluently read code in JavaScript, Python, Java, and other languages while constantly shifting between different projects.

AI-generated triage comments help engineers quickly understand alerts, filter out irrelevant warnings, and escalate only the vulnerabilities that genuinely require the development team's attention.

How PT Naira enhances PT Application Inspector

• Identifies actual vulnerabilities within analyzer alerts. During internal testing across more than 3,000 warnings, PT Naira correctly identified 94% of real vulnerabilities.
• Filters out false positives during triage, a task that typically consumes the bulk of an AppSec engineer's time. On a test dataset, the model successfully eliminated 30% of false positives.
• Prepares alert justifications for discussions with developers. The AI triage reasoning matches an AppSec expert's assessment in 75% of cases.
• Analyzes code across various programming languages without requiring the engineer to manually dig into each separate project.

The model is deployed and operates within the secure Positive Technologies cloud. User data is never shared with third parties, and companies do not need to purchase expensive GPUs to access AI-powered code analysis.

In addition to triage, PT Application Inspector version 6.0 features the MOLOT neural network. This model detects malicious code in Python, JavaScript, and TypeScript projects. Unlike traditional SAST tools, it analyzes the complete sequence of program actions rather than isolated code fragments. Malicious code often masquerades as legitimate operations, such as reading files, making network requests, or encrypting data. While these actions are harmless on their own, they can form a dangerous execution chain. The model highlights the specific lines of code that influenced its decision, which significantly accelerates the analyst's verification process.

How MOLOT enhances PT Application Inspector

• Detects malicious code by analyzing the execution chain of program actions rather than relying on isolated signatures or fragments.
• Identifies software supply chain attacks, including backdoors in external libraries and malicious packages from open-source repositories like PyPI and npm.
• Highlights the specific lines of code that influenced the model's decision, enabling analysts to verify results quickly.
• Delivers 15 to 30% higher accuracy on actual malicious packages from PyPI and npm compared to open-source alternatives.

PT Naira and MOLOT are integrated directly into the PT Application Inspector workflow. They help AppSec engineers focus on the vulnerabilities and threats that genuinely impact application security.

PT BlackBox Cloud scans running applications for vulnerabilities using a black-box testing approach. Following the scan, it generates a comprehensive report that security specialists must then analyze. PT Naira, the AI assistant, transforms this report into a clear action plan by explaining the identified flaws and suggesting exact remediation steps.

For every vulnerability detected, the PT BlackBox Cloud interface provides a card detailing the description, affected URL, and technical specifics. In the "How to fix" section, users can click the "Get Positive LLM recommendation" button. The system then gathers context about the vulnerability, such as the issue type, application characteristics, and technology stack, constructs a prompt, and sends it to PT Naira.

The model analyzes this context and generates tailored recommendations based on the specific application. It explains what is misconfigured, why it poses a security risk, and how to resolve the issue. This generation process takes just 5–7 seconds and is integrated directly into the vulnerability analysis workflow, eliminating the need to interact with the AI assistant separately.

How PT Naira enhances PT BlackBox Cloud

• Explains identified vulnerabilities in plain language, replacing dry technical jargon from the report.
• Generates step-by-step remediation instructions for each vulnerability, tailored to the specific application and its technology stack.
• Streamlines prioritization, enabling specialists to quickly understand what to fix first instead of manually sifting through the entire report.
• Lowers the barrier to entry for junior specialists who may find it challenging to interpret scan results on their own.

PT Naira operates within the secure Positive Technologies cloud as a SaaS solution. Integration with PT BlackBox Cloud is fast and requires no additional configuration. All vulnerability data remains strictly under the control of Positive Technologies and is never shared with third parties or external LLMs.