AI to Detect the Threats Firewalls Ignore

Traditional firewalls rely on known signatures — they’re blind to novel or adversarially-crafted traffic patterns. This talk walked through why a learned, behavior-based detector can catch what static rules miss, using the two-tier ML-based NIDS I’ve been building for Industrial IoT as a running example.

The second half focused on the catch: an ML-based defense is itself an attack surface. If a classifier makes the “is this traffic malicious” decision, an adversary now has an incentive to craft inputs that fool the classifier specifically — the same adversarial robustness problem that shows up throughout AI safety, just with a very concrete, very exploitable instance of it.