Attackers can use machine learning in several ways. The first -- and simplest -- is by building their own machine learning environments and modeling their own malware and attack practices to determine the types of events and behaviors looked for by defenders. A sophisticated piece of malware, for example, might modify local system libraries and components, run processes in memory and communicate with one or more domains owned by an attacker's control infrastructure. All these activities in combination create a profile known as tactics, techniques and procedures (TTPs). Machine learning models can observe TTPs and use them to build detection capabilities.

Cybersecurity has benefited from advancements in machine learning and AI.