APPLICATION OF ARTIFICIAL INTELLIGENCE TO IMPROVE THE EFFICIENCY OF INFORMATION SECURITY

ABSTRACT

The article examines the possibilities of applying artificial intelligence technologies to improve information security in organizations. The main areas of machine learning application are analyzed, including anomaly detection, information security event analysis, malicious activity detection, incident response support, and risk assessment. Particular attention is paid to limitations and threats arising from the implementation of intelligent systems, including data poisoning, sensitive information disclosure, model vulnerabilities, and excessive automation of decisions. A practical approach to integrating artificial intelligence into an enterprise information security management system while maintaining specialist control is proposed.

Keywords: artificial intelligence; information security; machine learning; cybersecurity; anomaly detection; incident analysis; risk management.

Introduction

Digitalization of organizational activities leads to a continuous increase in the amount of information processed by information systems. At the same time, the number of events that information security specialists need to analyze is also increasing. Audit logs, network connections, user actions, database requests, and security system messages generate significant amounts of data. When such volumes of information are processed manually, the probability of missing a genuinely dangerous event increases.

Traditional information security tools remain the foundation of information system protection. However, modern infrastructures are becoming more distributed, while attacks are becoming more complex and multi-stage. Therefore, technologies capable of processing large amounts of data, identifying atypical relationships, and assisting specialists in decision-making are becoming increasingly important. Artificial intelligence is one of these areas.

NIST considers artificial intelligence risk management to be a continuous process covering the design, development, deployment, operation, and evaluation of AI systems [1]. This approach is particularly important for information security because an intelligent system itself becomes part of the protected infrastructure and, at the same time, a tool for protecting it.

1. Capabilities of Artificial Intelligence in Information Security

Artificial intelligence in information security should be viewed not as a replacement for existing security tools, but as an additional analytical layer. Its purpose is to process data, identify patterns, and generate indicators that can be used to detect threats in a timely manner.

One of the most common areas is anomaly detection. An algorithm can build a representation of normal behavior for users, workstations, servers, and network nodes. When there is a significant deviation from the established model, the system generates an alert. This approach is especially useful in situations where it is impossible to define all variants of suspicious activity in advance.

The second area is intelligent analysis of event logs. In large information systems, the number of records can be so high that a specialist is physically unable to check them all. Machine learning makes it possible to group events, correlate them by time, source, and nature of actions, and identify sequences that require additional investigation.

The third area is related to incident response support. An intelligent system can automatically classify an event, determine its probable priority, compare it with previously observed scenarios, and suggest a sequence of actions. At the same time, the final decision on critical operations should remain with the responsible specialist. This principle reduces the risk that a model error will directly lead to the shutdown of an information system or the blocking of a legitimate user.

Table 1.

Main areas of AI application in information security

Identification of deviations from normal behavior

Incident analysis

SIEM events, security alerts, temporal sequences

Event prioritization and grouping

Malicious activity detection

Files, processes, network traffic, behavioral indicators

Early detection of suspicious activity

Risk assessment

Information about assets, vulnerabilities, and events

Identification of the most critical security areas

Response support

Incident records and analysis results

Generation of recommendations for specialists

The areas presented are not mutually exclusive. In practice, they are combined into a single monitoring framework in which the results of one algorithm can be used to refine the operation of another. For example, information about an abnormal user login can be correlated with network activity and access to critical resources.

2. Advantages of Intelligent Analysis

The main advantage of AI is its ability to work with large amounts of heterogeneous data. The system can simultaneously consider the temporal characteristics of an event, user context, device type, nature of the network connection, and the history of similar actions. For a specialist, this means reducing the number of routine operations and focusing on investigating the most significant incidents.

Another advantage is the ability to identify previously unknown combinations of indicators. Manually defined rules are effective for known scenarios, but they require constant updating. Machine learning makes it possible to complement the signature-based approach with behavioral analysis. As a result, protection becomes more adaptive.

At the same time, model effectiveness directly depends on the quality of the input data. If the training dataset does not reflect the organization's actual operations, the algorithm may generate a large number of false positives or miss dangerous events. Therefore, AI implementation should be accompanied by data quality control, periodic model validation, and analysis of its results.

3. Risks of Using Artificial Intelligence

The implementation of intelligent technologies creates not only advantages but also additional risks. An organization must protect not only traditional information resources but also data, models, software components, and AI system interfaces. ENISA emphasizes the need to consider artificial intelligence security throughout its entire life cycle, including threat analysis, supply-chain protection, and specific measures for AI components [2].

One of the threats is data poisoning. If deliberately modified information enters a training dataset, the model may acquire undesirable behavior. As a result, the system may become less capable of recognizing certain types of events or, conversely, generate a large number of false alerts. Therefore, data sources should be verified, and the processes of preparing and updating datasets should be documented.

Another risk is the disclosure of sensitive information. When using generative models, employees may transfer documents, source-code fragments, credentials, or internal infrastructure descriptions to an external service. Therefore, an organization should establish clear rules for working with such tools and determine which categories of data may be transferred to AI systems.

A separate group of risks concerns vulnerabilities in applications using large language models. OWASP materials identify current risks including prompt injection, sensitive information disclosure, supply-chain vulnerabilities, data poisoning, improper handling of model outputs, excessive agency, and vector and embedding vulnerabilities [3]. These risks demonstrate that securing an AI application cannot be reduced to the quality of the model itself.

4. Integration of AI into Information Security Management

Rational implementation of artificial intelligence begins with defining a specific task. An organization does not need to use a complex model in every process. At the initial stage, it can select an area where there is a large amount of repetitive data and a clear performance criterion. For example, event classification in information security may be such an area.

The next stage is data preparation. It is necessary to identify sources, formats, retention periods, reliability levels, and access procedures. For each data category, rules for anonymization or restrictions on use should be established. This approach corresponds to the general logic of an information security management system, in which security is considered through risk management and continuous improvement of processes [4].

After data preparation, a model is selected and quality criteria are established. Not only classification accuracy is important, but also the number of false positives, event processing time, robustness to changing conditions, and understandability of the result for a specialist. If a model cannot be adequately tested or its outputs cannot be reasonably interpreted, its use in a critical process should be limited.

The final stage is operational control. The model should be regularly checked for relevance, and changes in the infrastructure should be taken into account during its updating. When new types of devices, software, or work scenarios appear, the previous model may lose effectiveness. Therefore, AI should be viewed as a component of a continuous security management process rather than as a software product installed once.

5. Practical Application Model

For a hypothetical enterprise, the following sequence of an intelligent security framework can be proposed. First, data is received from network equipment, servers, workstations, and audit systems. Then preprocessing is performed: duplicates are removed, timestamps are standardized, and necessary features are extracted. The model then determines the probability of anomalous behavior and sends the result to the monitoring system.

At the next stage, events are grouped according to their criticality. Low-priority messages remain in the general log, while higher-risk events are forwarded to a specialist. If the system has a sufficient level of reliability, some safe routine actions can be automated, such as creating an incident record or requesting additional information. Operations that may lead to data loss or unavailability of critical resources should be performed only after confirmation by an authorized employee.

This approach makes it possible to combine the advantages of automation and expert control. System effectiveness can be evaluated using several indicators: average incident detection time, number of missed events, false-positive rate, incident processing time, and specialists' labor costs.

E = (T₀ − T₁) / T₀ × 100 %

where E is the relative reduction in incident processing time; T₀ is the average processing time before implementation of intelligent analysis; T₁ is the average processing time after implementation. The indicator is not a universal measure of system quality, but it allows implementation results to be quantitatively compared when the measurement methodology remains unchanged.

Project evaluation should also take the economic effect into account. A reduction in analysis time should not be achieved at the expense of an increase in missed incidents. Therefore, performance indicators should be considered together: faster processing must be accompanied by an acceptable level of accuracy and a controllable number of false positives.

Conclusion

Artificial intelligence is becoming an important tool for the development of information security. Its main value lies in its ability to process large amounts of data and help specialists identify patterns that are difficult to detect through manual analysis. The most promising areas include anomaly detection, intelligent event correlation, incident classification, and decision support.

At the same time, the use of AI requires a change in the approach to security. It is necessary to protect not only traditional information resources but also data, models, software components, and interfaces through which interaction with an AI system takes place. The recommendations of NIST, ENISA, and OWASP show that risk management should cover the entire life cycle of an intelligent solution [1–3].

Thus, the most rational approach is the gradual implementation of AI in information security with a clearly defined area of application, data quality control, measurable performance criteria, and mandatory specialist involvement in critical decisions. This approach makes it possible to obtain practical benefits from automation while maintaining the controllability and reliability of the security system.

References:

1. Tabassi E. Artificial Intelligence Risk Management Framework (AI RMF 1.0). Gaithersburg: National Institute of Standards and Technology, 2023. 42 p. DOI: 10.6028/NIST.AI.100-1.
2. European Union Agency for Cybersecurity. Multilayer Framework for Good Cybersecurity Practices for AI. Athens: ENISA, 2023. 57 p.
3. OWASP Foundation. OWASP Top 10 for Large Language Model Applications 2025 [Electronic resource]. URL: https://genai.owasp.org/resource/owasp-top-10-for-llm-applications-2025/ (accessed: 04.09.2026).
4. GOST R ISO/IEC 27001-2021. Information technology. Security techniques. Information security management systems. Requirements. Moscow: Standartinform, 2021.
5. European Union Agency for Cybersecurity. Artificial Intelligence Cybersecurity Challenges [Electronic resource]. URL: https://www.enisa.europa.eu/publications/artificial-intelligence-cybersecurity-challenges (accessed: 04.09.2026).
6. NIST. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile. NIST AI 600-1. Gaithersburg: National Institute of Standards and Technology, 2024. DOI: 10.6028/NIST.AI.600-1.