Contents -- Preface xiii -- Acknowledgments xvii -- Acronyms xix -- 1 Cybersecurity in the Era of Artificial Intelligence 1 -- 1.1 Artificial Intelligence for Cybersecurity . 2 -- 1.1.1 Artificial Intelligence 2 -- 1.1.2 Machine Learning 4 -- 1.1.3 Data-Driven Workflow for Cybersecurity . 6 -- 1.2 Key Areas and Challenges 7 -- 1.2.1 Anomaly Detection . 8 -- 1.2.2 Trustworthy Artificial Intelligence . 10 -- 1.2.3 Privacy Preservation . 10 -- 1.3 Toolbox to Build Secure and Intelligent Systems . 11 -- 1.3.1 Machine Learning and Deep Learning . 12 -- 1.3.2 Privacy-Preserving Machine Learning . 14 -- 1.3.3 Adversarial Machine Learning . 15 -- 1.4 Data Repositories for Cybersecurity Research . 16 -- 1.4.1 NSL-KDD . 17 -- 1.4.2 UNSW-NB15 . 17 -- v -- 1.4.3 EMBER 18 -- 1.5 Summary 18 -- 2 Cyber Threats and Gateway Defense 19 -- 2.1 Cyber Threats . 19 -- 2.1.1 Cyber Intrusions . 20 -- 2.1.2 Distributed Denial of Services Attack . 22 -- 2.1.3 Malware and Shellcode . 23 -- 2.2 Gateway Defense Approaches 23 -- 2.2.1 Network Access Control 24 -- 2.2.2 Anomaly Isolation 24 -- 2.2.3 Collaborative Learning . 24 -- 2.2.4 Secure Local Data Learning 25 -- 2.3 Emerging Data-Driven Methods for Gateway Defense 26 -- 2.3.1 Semi-Supervised Learning for Intrusion Detection 26 -- 2.3.2 Transfer Learning for Intrusion Detection 27 -- 2.3.3 Federated Learning for Privacy Preservation . 28 -- 2.3.4 Reinforcement Learning for Penetration Test 29 -- 2.4 Case Study: Reinforcement Learning for Automated Post-Breach -- Penetration Test . 30 -- 2.4.1 Literature Review 30 -- 2.4.2 Research Idea 31 -- 2.4.3 Training Agent using Deep Q-Learning 32 -- 2.5 Summary 34 -- vi -- 3 Edge Computing and Secure Edge Intelligence 35 -- 3.1 Edge Computing . 35 -- 3.2 Key Advances in Edge Computing . 38 -- 3.2.1 Security 38 -- 3.2.2 Reliability . 41 -- 3.2.3 Survivability . 42 -- 3.3 Secure Edge Intelligence . 43 -- 3.3.1 Background and Motivation 44 -- 3.3.2 Design of Detection Module 45 -- 3.3.3 Challenges against Poisoning Attacks . 48 -- 3.4 Summary 49 -- 4 Edge Intelligence for Intrusion Detection 51 -- 4.1 Edge Cyberinfrastructure . 51 -- 4.2 Edge AI Engine 53 -- 4.2.1 Feature Engineering . 53 -- 4.2.2 Model Learning . 54 -- 4.2.3 Model Update 56 -- 4.2.4 Predictive Analytics . 56 -- 4.3 Threat Intelligence 57 -- 4.4 Preliminary Study . 57 -- 4.4.1 Dataset 57 -- 4.4.2 Environment Setup . 59 -- 4.4.3 Performance Evaluation . 59 -- vii -- 4.5 Summary 63 -- 5 Robust Intrusion Detection 65 -- 5.1 Preliminaries 65 -- 5.1.1 Median Absolute Deviation . 65 -- 5.1.2 Mahalanobis Distance 66 -- 5.2 Robust Intrusion Detection . 67 -- 5.2.1 Problem Formulation 67 -- 5.2.2 Step 1: Robust Data Preprocessing 68 -- 5.2.3 Step 2: Bagging for Labeled Anomalies 69 -- 5.2.4 Step 3: One-Class SVM for Unlabeled Samples . 70 -- 5.2.5 Step 4: Final Classifier . 74 -- 5.3 Experiment and Evaluation . 76 -- 5.3.1 Experiment Setup 76 -- 5.3.2 Performance Evaluation . 81 -- 5.4 Summary 92 -- 6 Efficient Preprocessing Scheme for Anomaly Detection 93 -- 6.1 Efficient Anomaly Detection . 93 -- 6.1.1 Related Work . 95 -- 6.1.2 Principal Component Analysis . 97 -- 6.2 Efficient Preprocessing Scheme for Anomaly Detection . 98 -- 6.2.1 Robust Preprocessing Scheme . 99 -- 6.2.2 Real-Time Processing 103 -- viii -- 6.2.3 Discussions 103 -- 6.3 Case Study . 104 -- 6.3.1 Description of the Raw Data 105 -- 6.3.2 Experiment 106 -- 6.3.3 Results 108 -- 6.4 Summary 109 -- 7 Privacy Preservation in the Era of Big Data 111 -- 7.1 Privacy Preservation Approaches 111 -- 7.1.1 Anonymization 111 -- 7.1.2 Differential Privacy . 112 -- 7.1.3 Federated Learning . 114 -- 7.1.4 Homomorphic Encryption 116 -- 7.1.5 Secure Multi-Party Computation . 117 -- 7.1.6 Discussions 118 -- 7.2 Privacy-Preserving Anomaly Detection . 120 -- 7.2.1 Literature Review 121 -- 7.2.2 Preliminaries . 123 -- 7.2.3 System Model and Security Model 124 -- 7.3 Objectives and Workflow . 126 -- 7.3.1 Objectives . 126 -- 7.3.2 Workflow . 128 -- 7.4 Predicate Encryption based Anomaly Detection . 129 -- 7.4.1 Procedures 129 -- ix -- 7.4.2 Development of Predicate . 131 -- 7.4.3 Deployment of Anomaly Detection 132 -- 7.5 Case Study and Evaluation . 134 -- 7.5.1 Overhead . 134 -- 7.5.2 Detection . 136 -- 7.6 Summary 137 -- 8 Adversarial Examples: Challenges and Solutions 139 -- 8.1 Adversarial Examples . 139 -- 8.1.1 Problem Formulation in Machine Learning 140 -- 8.1.2 Creation of Adversarial Examples . 141 -- 8.1.3 Targeted and Non-Targeted Attacks . 141 -- 8.1.4 Black-Box and White-Box Attacks 142 -- 8.1.5 Defenses against Adversarial Examples 142 -- 8.2 Adversarial Attacks in Security Applications 143 -- 8.2.1 Malware 143 -- 8.2.2 Cyber Intrusions . 143 -- 8.3 Case Study: Improving Adversarial Attacks Against Malware -- Detectors 144 -- 8.3.1 Background 144 -- 8.3.2 Adversarial Attacks on Malware Detectors 145 -- 8.3.3 MalConv Architecture 147 -- 8.3.4 Research Idea 148 -- 8.4 Case Study: A Metric for Machine Learning Vulnerability to -- Adversarial Examples . 149 -- 8.4.1 Background 149 -- 8.4.2 Research Idea 150 -- 8.5 Case Study: Protecting Smart Speakers from Adversarial Voice -- Commands . 153 -- 8.5.1 Background 153 -- 8.5.2 Challenges 154 -- 8.5.3 Directions and Tasks 155 -- 8.6 Summary 157 -- xi.