Causal AI for Predictive Cybersecurity Threat Intelligence

Abstract

The rapid evolution of cyber threats makes it necessary to adopt smart and reliable cybersecurity solutions that able to detect threats and prevent them in advance. The traditional cybersecurity approaches include mainly the correlation-based algorithms that create correlations between certain events and statistic data in the past but do not reveal any reason for a particular cyber-attack. The idea of the causal AI provides a new approach that is based on researching causations in the complicated cybersecurity environment. With the help of causal inference methods like causal graphs, counterfactuals, and Structural Causal Models (SCMs), it becomes possible to reveal causality of the cyber incidents that occur due to certain weaknesses, behavior, and actions of attackers. Furthermore, the adoption of causal AI facilitates cyber-attack detection, risk evaluation, and prediction of cascades triggered by cybersecurity problems. The implementation of the causal AI also enhances the capability of conducting threat intelligence analysis using scenario-based evaluation. There are several challenges to be aware of when developing a causal AI system including data quality issues, scalability concerns, problems with interpretation of models, and integrability with other cybersecurity modules.