ISSN: 2832-790X DOI: 10.33552/OJRAT.2024.03.

000551

Online Journal of
Robotics & Automation Technology

Research Article Copyright © All rights are reserved by Cheryl Ann Alexander

AI/ML, Data Science, and Automation in Cybersecurity:

Methods and Applications in Healthcare

Cheryl Ann Alexander1* and Lidong Wang2

1
Institute for IT Innovation and Smart Health, Mississippi, USA
2
Institute for Systems Engineering Research, Mississippi State University, Mississippi, USA

*Corresponding author: Cheryl Ann Alexander, Institute for IT Innovation and Smart Received Date: May 10, 2024
Health, Mississippi, USA Published Date: June 06, 2024

Abstract
The support of artificial intelligence (AI)/machine learning (ML), data science, and automation in cybersecurity are introduced in this paper,
respectively. Their specific methods or tools in cybersecurity are discussed. The applications of AI/ML, data science, and automation in healthcare
cybersecurity are presented as case studies, respectively. Both defenders and cyber criminals have access to AI/ML, data science, and automation.
There are challenges in practicing robust cybersecurity. It is significant to maintain strict cybersecurity policies and use advanced or updated
technologies for the detection, prevention, or mitigation of cyberattacks and cyber incidents. Healthcare depends on cybersecurity to keep personal
health information (PHI) safe because healthcare data is either in motion or at rest. Cybersecurity in healthcare then becomes a primary concern to
meet HIPAA standards and hospital standards. Healthcare information travels more often than ever before as providers are using mobile devices,
telemedicine, and mobile imaging and diagnostics.
Keywords: cybersecurity; artificial intelligence (AI); machine learning (ML); deep learning (DL); data science; cybersecurity automation; healthcare

Introduction
Data science has the potential in cybersecurity. It offers tools for
Detecting threats and protecting systems and their data
synthesizing a high volume of data quickly, detecting unforeseen
sources, including intrusion detection/prevention systems,
patterns, etc. The smart adversary is a new threat model, in which
identity and access management, fraud detection/anti-fraud, data
an adversary employs sophisticated techniques for attacks. The
loss prevention, antivirus/antimalware, and risk and compliance
attacks can target training data, testing data, and model parameters
management is a function of AI-based tools. There are challenges
in AI/ML. The smart adversary can erode confidence and trust in
in the training of artificial intelligence (AI)/machine learning (ML)
an AI/ML system, target a specific class for misclassifications, and
models for complex data due to
evade automatic detection by obfuscation. ML should utilize various
1. data from various sensors (possible problems in data feature vectors and objective functions to minimize the impacts of
fusion), the smart adversary [1].

2. noisy data streams, and The utilization of an automated method for cybersecurity threat
intelligence was studied. The selected use case is an international
3. data with various modalities.
leading organization in cybersecurity, demonstrating new dynamic

This work is licensed under Creative Commons Attribution 4.0 License OJRAT.MS.ID.000551. Page 1 of 7
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

ways to support decision-making at all levels (operational, tactical, and the utilization of a reasoner [2]. Table 1 [3] lists some attacks,
and strategic) while being under attacks. An integrated architecture descriptions, and their targeted objects. Table 2 [4] shows some
was developed that combines cyber threat intelligence (CTI) and risky sources (data, devices, and technologies) in healthcare,
dynamic risk assessment and management (DRA/DRM). It is associated vulnerabilities, current risk management, and
based on ontologies, Semantic Web Rule Language (SWRL) rules, recommended strategies.

Table 1: Attacks and targeted objects.

Attacks Descriptions Targeted Objects

Phishing and social
Utilizing emails or social-engineering methods to get confidential information Databases
engineering attacks
Injecting malware-laden or malicious advertisement into legitimate advertising webpag-
Malvertising Databases
es or networks
Watering hole attacks Directly attacking a specific group, leading to the impersonation of the attacker to the
Databases
(phishing) daily work site of the group
System misconfigura- Detecting the flaws or faults of unpatched yet software and exploiting them to compro-
Technical equipment
tion exploitation mise a system
Vulnerability exploita- Utilizing software bugs or an unaddressed to take control of them through a dedicated
Technical equipment
tion program
Getting into the internal, corporate networks utilizing back doors, embedded with
3rd party vendors
specific functions or programmable implemented features in devices in the internal Technical equipment
(backdoor)
network
Internal network, ICT (informa-
Man-in-the-Middle An attacker plays between the application and the user, intercepting data packets or
tion and communications technol-
(network spoofing) impersonating a page.
ogy) equipment

Table 2: Risky sources, associated vulnerabilities, current risk management, and recommended strategies.

Aspects Details/Examples
Risky data, devices, and technologies Electronic data, medical devices, and tele-medicine
Out-of-date systems
Rapid innovation
Internal threats
Associated vulnerabilities Interoperability
Constant accessibility
Focus on medical care
Lack of regulation
Lack of resources
Detection and response
Technical measures
Current risk management Regulatory measures
Devices requirements
Insurance
Technical measures
Build into it, incorporating cybersecurity as an integral element
Recommended strategies Group efforts
Risk management
Training

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 2 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

The objective of this paper is to introduce the methods of AI/ and learn new threats. AI uses predictive analysis and AI-powered
ML, data science, and automation in cybersecurity, and discuss cybersecurity tools that can estimate many vulnerabilities and
their applications in cybersecurity of healthcare. The subsequent therefore recommend or predict actions. A comprehensive view
sections of the paper are organized as follows: the second section, of vulnerabilities and potential actions to avoid threats leads AI to
the third section, and the fourth section introduce AI/ML, data correlate the data from a multitude of sources, which can provide a
science, and automation in cybersecurity, respectively. The fifth comprehensive point of view for potential threats. This becomes a
section, the sixth section, and the seventh section present AI/ holistic approach enabling early detection of any advanced or muti-
ML, data science, and automation in cybersecurity of healthcare, staged attacks. AI streamlines administrative activities, improving
respectively. The eighth section is the conclusion. efficiency.

AI/ML in Cybersecurity Cybersecurity AI acts by analyzing data stream within the

system and constructing some interpretation of normal or abnormal
AI continuously monitors network traffic, user behaviors,
for users, computers, or other devices. However, cybersecurity AI
and system anomalies. AI swiftly recognizes unusual patterns,
is very competent in recognizing the difference between normal
revealing cyberattacks. An instant response can be proactive for
network activities and the works of a malicious actor, but AI can
threat projections and can foster an immediate response, which
issue an immediate response to stop the spread of an attack. AI
can prevent a breach. Furthermore, new threats can teach AI-
applications in cybersecurity, healthcare, etc. were introduced. A
powered cybersecurity to adapt and learn when new threats arise.
SWOT analysis of AI is shown in Table 3 [5]. Intelligence, security,
Predictive analytics can forecast possible vulnerabilities and further
risks/threats, privacy, etc. are included in the table.
recommend actions. AI-powered cybersecurity can also understand

Table 3: SWOT analysis of AI.

Strengths Weaknesses
• Intelligence

• Smart AI apps
• Risk of losing data
• Daily applications
• Computation issues
• Reduction of errors
• Lack of efficient algorithms
• Unbiased decision
• Threats
• Available 24/7
• Fewer than ideal samples for algorithm development
• Adaptability
• Lack of ability to think for oneself
• AI utilized in risky situations

• Limitless functions (depending on programming)

Opportunities Threats
• Security threats of production AI
• Protect the privacy on sensitive data
• Privacy issues
• Development of novel tools, reducing the complexity
• Misuse
• Uplift the 3D immersive experience
• Cyber-syndrome
• Granting funds from various sources
• Legal risks
• Improvement in the performance, reducing the training time, and en-
hancing robustness with existing AI models • Personal data abuse (ethical issues)

• AI is used to do terrible things (e.g., lethal autonomous

weapons)

Malicious actors also use AI to design and execute attacks; impersonation, password guessing, building better malware,
ransomware, rapid exploitation of vulnerabilities, developing penetration testing tools, and stealth attacks. AI-generated phishing
phishing emails, deep target reconnaissance, developing complex emails may be opened at a higher rate due to the ability of AI to
malware code, automated attacks, etc. Cyber criminals have target users and recognize patterns. For example, ChatGPT, an AI-
developed complex malware codes, automation of attacks, etc. powered chatbot can be used in the development of malware and
Malicious actors have also multiplied AI capacity, including human ransomware.

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 3 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

An extensive view of ML algorithms was provided, focusing on where automation, data-driven intelligence, and decision-making
how they can be used for intelligent data analytics and automation enable more proactive cyber protection than traditional methods.
in cybersecurity. Potential real-world use cases were explored Various ML methods used in cybersecurity are shown in Table 4 [6].

Table 4: Various ML methods and their tasks in cybersecurity.

Methods Examples of Tasks

Creating an intrusion detection system
k-nearest neighbors (KNN)
Reducing the false alarm rate
K-means and KNN Creating an intrusion detection system
Selecting features of security, detecting & classifying intrusions
Support Vector Machine (SVM)
Classifying cyberattacks such as probing and DoS
Association Rule Creating an intrusion detection system (IDS)
Detecting DoS
Random Forest (RF) Detecting cyber anomalies
Intrusion detection system
Decision Tree Selecting features of security, creating an IDS
Naive Bayes Classifier (NBC) Detecting anomalies
Principal component analysis (PCA) Processing security data with high dimensionality
Ensemble learning Detecting cross-site scripting (XSS) attacks
Q-Learning Detecting distributed denial-of-service (DDoS)
Deep learning: convolutional neural network (CNN) Classification of malware traffics
Deep learning: LSTM, recurrent neural network (RNN) Detecting/classifying anomaly intrusions & attacks
Multi-CNN Constructing an IDS
CNN + long short-term memory (LSTM) Detecting/mitigating phishing & Botnet attacks

Data Science in Cybersecurity taught to predict prospective cyber threats before they occur.

Data science is a multidisciplinary field, combining math, c. Data science has a critical role in analyzing the scope
statistics, computer science, AI/ML, specialized programming, of a security incident response and identification of any
sophisticated analytics, and domain expertise to extract data and compromised data. ML models can assist in tracing the origin
expose valued insights from the data. By using various tools and of the attack and assist in mitigating the damage.
techniques, data can be studied and analyzed in massive volumes, How cybersecurity data science is applied to the data-driven
finding unseen patterns, and drawing meaningful insights from process for intelligent decision-making in smart cybersecurity
the data. Listed below are some of the major applications of data services and systems was studied. A generic multi-layered
science in cybersecurity: framework of a cybersecurity data science model was developed
a. ML is a data science tool used for anomaly detection where based on ML. In the framework, data are captured from various
ML algorithms are used to analyze massive amounts of datasets sources, and data analytics complement the latest data-driven
and identification of any abnormal patterns or behaviors. patterns to provide smart cybersecurity solutions. The framework
is shown in Figure 1 [7].
b. ML applies predictive cybersecurity as ML models may be

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 4 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

Figure 1: An ML-based framework for smart cybersecurity.

Automation in Cybersecurity technology, and blocking of common installation paths, defenders

can permanently leverage automation. However, malicious actors
The integration of automated infrastructure management
can still use automated software to recognize invaluable data such
(AIM) into cybersecurity was discussed. AIM’s automation of
as credit cards and passwords. Although most automated cyber
infrastructure management processes improves the effectiveness
intelligence tools were designed to secure systems, embracing
and speed of cybersecurity measures [8]. A risk analysis method was
systems for security monitoring or alerting, network intrusion
developed, and major steps were followed that included deciding
detection and prevention, and vulnerability management, is also
the automation level, finding cyberattack targets, discovering
suggested. Various types of security automation tools include:
cyberattack methods, defining cyberattack consequences, and
performing risk ratio evaluation. a. Security information and event management (SIEM) tools

The cybersecurity automation system is an advanced system b. Security orchestration, automation, and response (SOAR)
driven by AI/ML, involving the automation of cybersecurity tools
procedures so that they are faster and work more effectively. c. Vulnerability management tools-Automatically scan IT
Streamlining manual and often arduous tasks, cybersecurity resources for vulnerabilities, recognize flaws, classify them,
automation systematizes the workflow. Because cybersecurity prioritize the risks, and propose remediation activities.
automated systems can analyze real-time data, they provide
efficient protection against cyberattacks and require only the d. Endpoint protection tools-The endpoints include network
implementation of automated systems. However, automated connections, Internet of Things (IoT) devices, cloud-based
compliance observation is utilized to monitor networks and systems applications, PCs, etc. Major categories of endpoint protection
for compliance with standards and regulations in healthcare, which tools contain anti-malware solutions, response software,
helps identify and handle any potential compliance problems. endpoint detection, anti-malware solutions, etc.
Automated intelligence collection, penetration testing, and AI/ML, AI/ML in the Cybersecurity of Healthcare
etc. are excellent models of automation in cybersecurity.
Impactful vectors directed at healthcare include wireless
Through the conduction of malware analysis, detection technology compromise (especially Bluetooth and Wi-Fi),
of data exfiltration, implementation of vulnerability scanning compromise of vulnerabilities, phishing attacks, compromise of

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 5 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

remote access technologies, credential compromise, etc. Major establishes a baseline user profile that detects deviances from
contributions of AI to healthcare cybersecurity include the normal performance and triggers alerts. Extremely successful
following: in the identification of insider threats and protects from
unauthorized access to patient data.
a. Identification of vulnerabilities and threats: AI can
examine patterns in network traffic and user activity in the c. Data science can design role-based access control systems,
healthcare environment to flag any abnormalities from normal while cybersecurity confirms that unauthorized persons cannot
actions. Natural language processing (NLP) scans for social gain access to sensitive patient data.
engineering attacks or documents and communications to
d. Encrypting data at rest and in transit is crucial to protect
identify signs of emergent cyber threats.
patient information. Data science can be used for implementing
b. Behavioral modeling is used for identifying and encryption techniques whereas cybersecurity can ensure their
responding to breaches using AI to improve identification and efficacy.
isolation of threats much quicker than traditional security
e. Data science facilitates the design of secure data-sharing
methods when a security breach does occur.
protocols, certifying that sensitive patient data is only revealed
c. Medical devices are protected from attacks: If left exposed to authorized personnel. Workers, staff, and third parties who
to remote breaches smart medical devices pose significant do not have the encryption key cannot access the data. This
threats to patient safety but AI helps address the most aids healthcare facilities in tracking and auditing data access,
challenging barriers to safeguarding these devices. improving security and accountability.

d. Increasing accuracy and efficiency: AI analyzes patient f. With the number of IoT and IoMT in healthcare, data
outcomes and treatment efficiency based on historical data, science must control and interpret their data for better patient
which helps healthcare providers enhance their practices and care, while cybersecurity guarantees the defense of these
provide better patient care quality. devices from probable attacks.

e. Ensure privacy and compliance: There is a need for AI- g. Threat intelligence is the process by which data
driven systems to constantly monitor data access and usage, science gathers data on the latest cybersecurity threats and
guaranteeing that only approved employees can access the vulnerabilities. Data science also aids the assimilation of
EMR/EHR/PHI, to meet conditions of regulations like HIPAA. AI threat intelligence into healthcare cybersecurity. Furthermore,
can also assist in audits and reports, streamlining the process healthcare organizations can stay updated on emergent threats
of developing fulfillment to regulatory authorities. Automating and tailor a security package to address their specific security
data access tracking helps AI reduce administrative burdens needs and specific risks. By staying updated on emerging
connected with compliance documentation. threats, healthcare organizations can tailor their security
measures to address these specific risks.
f. Enhancing third-party risk management: AI rapidly
analyzes questionnaires, audit security assessments, h. Data Science optimizes telehealth services by analyzing
documents, and additional materials from third-party payors patient data for remote diagnostics, while cybersecurity
to weigh their cyber risk levels in real time. safeguards the protected transmission of patient data in transit
over digital channels.
Healthcare use cases of ML for cybersecurity include predictive
analytics visualizing cybersecurity threats in a user interface for i. Routine audits are the key to complying with regulations
malware detection, anomaly detection for cybersecurity, etc. like HIPAA. Data science can aid in compliance monitoring
and identification of any areas of noncompliance, meanwhile,
Data Science in the Cybersecurity of Healthcare
cybersecurity can ensure data is protected over the entire
Patient information, clinical records, analysis, and process.
interpretation of medical data are analyzed by data science as the
j. Data privacy is the primary consideration in healthcare
collection and analysis occur by data science and ML. Because the
and medical data privacy must be guaranteed while detecting
purpose of advanced data science and ML algorithms is leveraging
fraudulent data and must not lose its usefulness. Data scientists
advanced analytics, AI/ML works together to gain significant
must construct frameworks and systems to protect sensitive
information from healthcare data. Working together, data science
data such as insurance and billing information. The need to
and cybersecurity work together to ensure the safety of patient
uncover fraud is essential. A healthcare organization should be
information yet able to harness the power of data for better
updated regularly to stop any data breaches.
healthcare outcomes, summarized by the following:
k. Equalizing patient privacy for the greater good of public
a. Unauthorized retrieval of patient records or unusual
health is yet a complex ethical dispute. There needs to be
data transfers inside a healthcare system can be an anomaly
a collaboration between data science and cybersecurity to
detection.
strike the right balance between data science collaboration
b. User and entity behavior analytics (UEBA) is a data and cybersecurity to protect patient data while granting data
science method that focuses on observing and analyzing user sharing for research purposes.
and entity performance within the healthcare network. UEBA

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 6 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551
 Online Journal of Robotics & Automation Technology Volume 3-Issue 1

Automation in the Cybersecurity of Healthcare and identification of any compromised data. Data science and
cybersecurity can work together and ensure the safety of patient
Automation can fight these tactics if used correctly by defenders.
information and good healthcare outcomes. Cybersecurity
Healthcare entities can utilize automation to build detections for
automation can perform real-time data analytics and provide
browsing behaviors and collecting visitor logs. When defenders
efficient protection against cyberattacks. In the healthcare sector,
use automated technologies, healthcare organizations can detect
automation helps detect threats more rapidly. Cybersecurity
threats more rapidly. Unfortunately, malicious actors may also
automation is a useful tool in healthcare for data privacy and
find automation useful in cybercrime efforts. Threat actors can
compliance. Unfortunately, cyber criminals also have access to AI/
utilize automation to move through phases faster. In the healthcare
ML and automation. It is the responsibility of the healthcare IT team
environment, data privacy and compliance are key. Automation,
to maintain strict cybersecurity policies and updated technologies.
therefore, reveals itself as an impressive tool. Enhancing security
with automation is as follows: Acknowledgements
a. Automation in identity and access management (IAM) The authors would like to thank Technology and Healthcare
processes: IAM harnesses biometric recognition, supported Solutions, Mississippi, USA for its support.
by automation, to admit access. Automation also quickens Conflict of interest
dynamic role-based access controls, adapting user permissions
in real time in response to a change in responsibilities or duties. Authors declare no conflict of interest.

b. Continuous monitoring and anomaly detection for data References

security: In scenarios like unauthorized data extractions from 1. Yener B, Gal T (2019) Cybersecurity in the era of data science: Examining
electronic health records (EHRs), immediately trigger alarms, new adversarial models. IEEE Security & Privacy 17(6): 46-53.
guaranteeing a quick response. 2. Riesco R, Villagrá V A (2019) Leveraging cyber threat intelligence for a
dynamic risk framework: Automation by using a semantic reasoner and
c. Automated threat detection and prevention systems: a new combination of standards (STIX™, SWRL and OWL). International
When malicious payloads are detected on MRI or CT scan Journal of Information Security 18(6): 715-739.
consoles, the systems can promptly insulate the devices, 3. Tubis AA, Werbińska Wojciechowska S, Góralczyk M, Wróblewski A,
preserving wider hospital network reliability. Ziętek B (2020) Cyber-attacks risk analysis method for different levels
of automation of mining processes in mines based on fuzzy theory use.
d. Integration of automation with security information Sensors 20(24): 7210.
and event management (SIEM) systems: Critical warnings 4. Wasserman L, Wasserman Y (2022) Hospital cybersecurity risks and
are automatically highlighted, certifying timely mitigation. gaps: Review (for the non-cyber professional). Frontiers in Digital
Automation also accelerates the creation of a visual dashboard Health 4: 862221.

within SIEMs for real-time threat landscapes. 5. Sharma N, Jindal N (2023) Emerging artificial intelligence applications:
metaverse, IoT, cybersecurity, healthcare-an overview. Multimedia Tools
e. Automated compliance assessments: Automated tools and Applications, 1-29.
leverage AI to conduct multidimensional compliance checks. 6. Sarker IH (2023) Machine learning for intelligent data analysis and
NLP can semantically analyze EHR annotations and access logs, automation in cybersecurity: current and future prospects. Annals of
identifying potential unauthorized access or data mishandling. Data Science 10(6): 1473-1498.
7. Sarker IH, Kayes ASM, Badsha S, Alqahtani H, Watters P, et al. (2020)
Conclusion Cybersecurity data science: an overview from machine learning
perspective. Journal of Big data 7: 1-29.
AI can continuously monitor network traffic, user behaviors,
and system anomalies. It can swiftly recognize unusual patterns, 8. Yaseen A (2024) Enhancing Cybersecurity through Automated
Infrastructure Management: A Comprehensive Study on Optimizing
revealing cyberattacks. ML can make cybersecurity simpler, more
Security Measures. Quarterly Journal of Emerging Technologies and
effective, more proactive, and less expensive. Data science has a Innovations 9(1): 38-60.
critical role in analyzing the scope of a security incident response

Citation: Cheryl Ann Alexander* and Lidong Wang. AI/ML, Data Science, and Automation in Cybersecurity: Methods and Applications Page 7 of 7
in Healthcare. On Journ of Robotics & Autom. 3(1): 2024. OJRAT.MS.ID.000551. DOI: 10.33552/OJRAT.2024.03.000551