General (ret) Professor Teodor FRUNZETI, Ph.D
Captain Ilie IFTIME, Ph.D Candidate
and immediately provide correct information from reliable sources, so that,
until the decision-maker adopts certain positions and takes measures, the
public is warned that the respective information is erroneous.
6. Improving activities specific to the counterintelligence domain
The phenomenon of digitalization entails, among other things, the
storage/migration of data and information into digital databases. Protecting
them becomes an increasingly difficult task as their volume and importance
grow, and as infrastructure expands and becomes interoperable with that of
other actors. In this respect, software based on artificial intelligence can
carry out preventive actions by monitoring and signaling unusual behaviors
of information networks, atypical migrations of files, the export of data in
small quantities but over the long term, suspicious access to databases, the
suspicious deletion of documents, increased interest in certain information,
amplified communications traffic between various entities, etc.; or it can
even undertake countermeasures, for example by blocking cyberattacks and
automating the response to the respective IT incident.
Constant supervision of personnel who have access to certain
databases and of their activity also remains a very important task. Espionage
and sabotage actions are based primarily on the recruitment of sources who
have access to these databases. Therefore, security checks carried out with
the help of artificial intelligence transform the process from a
periodic/occasional and reactive one into a continuous and predictive one.
Moreover, many more subjects can be analyzed simultaneously than a
classical security team could manage.
Thus, data relating to an individual’s profile, relational circle
(declared and undeclared), behavioral changes (significant fluctuations in
discourse, attitudes, emotions, and actions), and financial risk (a high risk
generated by contracted loans, various financial problems, etc., may
facilitate corruption and blackmail) can be identified and analyzed
automatically and in real time. In this respect, systems enhanced with AI
models have been developed, such as UAM (user activity monitoring),
responsible for recording, storing, and selecting data, and UEBA (user and
entity behavior analytics), used for the analytical component, which
compares a predefined “normal profile/history” model with each user’s
subsequent actions. The system identifies precisely those weak indicators
that, taken separately, mean nothing, but which, when correlated, signal
unusual behavior.
These types of systems are specific to each institution, being trained
on the basis of internal rules as well as the classical behavior of an
employee (the hours at which the platform is accessed, locations, temporal
indicators, the volume and flows of data being operated, usual queries, etc.).
In this case as well, the final decision regarding the labeling of a person as a
153