사이버 보안 전쟁도 AI 대 AI…“AI 실행 사이버 공격은 이미 현실”

The rapid discovery and deployment of artificial intelligence in cyber security is emerging as a new threat and a countermeasure. Korean Internet & Security Institute (KISA) plans to enhance its AI-based cyber security vulnerability detection and verification system to reduce the time from vulnerability discovery to action. KISA's center director stated that artificial intelligence can significantly expand the amount and speed of attacks that one person could handle.

Real-world examples of AI being used in cyber attacks include a Google threat information group that published attack codes in May last year, which bypassed a two-step authentication web-based system. Another case involved a Russian-backed hacking group using large language models to generate commands during a ransomware attack on Ukraine.

While artificial intelligence is being used more frequently in attack code development and execution, companies are lagging behind in response. According to a Verizon data breach investigation report, 29% of vulnerabilities exploited in 884 cases were exploited before or on the day they were publicly disclosed. The average time for companies to respond to major vulnerabilities increased to 43 days from 32 days the previous year.

The gap between attack and defense speed is widening. Companies must prioritize rapid vulnerability detection, analysis, and response in the face of increasing AI-powered attack speeds. Artificial intelligence can also be used for cyber defense. Major source code difficult for humans to review can be quickly analyzed for vulnerabilities, with validated vulnerabilities identified by experts.

KISA is participating in the GTAC open AI government and institution security cooperation program, analyzing domestic base facilities and commercial/open source software using the PT-5.5 cyber model to identify vulnerabilities. Of the 10 vulnerabilities identified, 5-6 were confirmed as actual vulnerabilities. KISA plans to strengthen its comprehensive lifecycle management system from vulnerability discovery to propagation, aiming to quickly scan all assets and prioritize, verify, and address high-risk vulnerabilities using AI.