Software developers face a daunting challenge with each new product they create. Not only does their software need to work well and accomplish what it promises to consumers, it also needs to be safe. No flaws. No gaps. No vulnerabilities within the code that hackers can exploit.
It's not easy. And, unfortunately, developers are often one step behind hackers, rather than one step ahead.
Zero-day exploits are some of the biggest threats developers face. The term "zero-day exploit" is just a fancy way of describing exploits that are discovered and abused by hackers before the software company has time to issue a patch.
The problem extends far beyond a single hacker who stumbles across a weak area within the code. If you're picturing some kid in his parents' basement, think again. While it may begin that way, it grows quickly. What happens is the hacker creates malware based on the vulnerability, and then sells it to other hackers on the Dark Web.
A frightening example of this was discovered back in February 2015 when the Windows operating system was targeted with malware that allowed cybercriminals to remotely control the infected computers. The issue spread worldwide and was able to infect several versions of Windows including Windows 7 and 8, and even Vista.
Although Microsoft issued a patch for the flaw within days, the malware had already spread at a rapid rate. By April, a new version of the original malware was discovered for sale on the Dark Web for $15,000. By July, a form of this malware appeared again, exploiting the same issue that was believed to be patched.
This is just one example, but it demonstrates how serious of a problem it is.
To combat the ever-growing threat of the sale of malicious software on the Dark Web, cybersecurity experts are looking for new ways to identify these zero-day exploits before hackers have the chance to develop malicious code and sell it. To do this, they're turning to a somewhat unexpected resource: artificial intelligence.
Researchers from Arizona State University have developed a system that can detect over 300 cyberthreat warnings per week. The system crawls the Dark Web to seek out hacker activity, and also gathers information that can be extracted by the team to pinpoint potential threats.