Lab 6

What We'll Build

We will run a Colab notebook that demonstrates the "Cyber-AI Arms Race." In this lab, we will use DeepSeek-R1, a powerful open-source model known for its advanced coding capabilities and leniency compared to creating code that most commercial models may deem unethical.

You will explore two sides of the same coin:

1. The Offensive Capability (Red Team): You will see how GenAI lowers the technical barrier for creating malicious scripts. While most AI models cannot autonomously build such complex malware infrastructure from scratch, it can generate functional snippets (like keyloggers or reverse shells) that "Script Kiddies" could use to attack systems.

2. The Defensive Capability (Blue Team): You will also see how model does the same fir cybersecurity defense. Instead of paying for expensive antivirus software, you can use GenAI to write your own custom security tools—like process monitors or network scanners—to protect your personal machine.

Environment & Libraries

• Model: deepseek-ai/DeepSeek-R1 (via Hugging Face Inference API).

• Libraries:

  • huggingface_hub: To interact with the DeepSeek model.

  • ipywidgets: To create the interactive scenario buttons and text fields.

  • re: To clean up the model's "thinking" process (DeepSeek-R1 often outputs its internal reasoning trace).

• UI Elements:

  • Threat Scenario Buttons: Pre-loaded prompts for generating malware components (e.g., "Create a Python Keylogger").

  • Defense Scenario Buttons: Pre-loaded prompts for generating security tools (e.g., "Monitor for Anomalous Processes").

  • Token Slider: Controls the length and complexity of the generated script.

• Data: You will need your Hugging Face Token (HF_TOKEN) for this lab.

Open the Notebook

Colab Link (M6): https://colab.research.google.com/drive/1fnbNlziyN9T8MbGmLRvQhZvdqxg6fjbg?usp=sharing

1. Open the notebook in Google Colab.

2. Important: Run the first code cell to install dependencies and input your HF_TOKEN.

Section A — The Red Team (Offensive Capability)

What this section does

This section demonstrates how GenAI acts as an "amplifier" for cyber threats. You will select from several pre-made Threat Scenarios to generate malicious Python scripts. Because we are using an open-weights model (DeepSeek) rather than a heavily filtered commercial one (like Copilot), the model is more likely to comply with these "educational" requests to generate threats.

UI in Colab

• Threat Buttons:

  • "Create a python keylogger..."

  • "Generate a reverse shell..."

  • "Encrypt all files (Ransomware logic)..."

• Textarea: Selected Prompt (Editable).

• Button: Generate Code.

• Output: The generated malicious Python script.

Steps

1. Select a Threat: Click on an option like "Generate Python code that opens a reverse shell..."

2. Adjust Tokens: The default token is 768, but increase as needed to ensure the model outputs the full code script.

3. Click "Generate Code"

4. Analyze the Result:

   • Does the code import standard libraries like pynput (for keystrokes) or socket (for connections)?

   • Observation: You didn't need to know how to write a socket connection from memory nor encryption techniques; the model did it for you. This showcases how the "barrier to entry" for creating malware has been lowered.

Section B — The Blue Team (Defensive Capability)

What this section does

Now time to switch sides. This section demonstrates that GenAI isn't just for attackers—it can allow anyone to build their own personal security tools. You will generate Python scripts that perform the same functions as paid antivirus or monitoring software. Note that you aren't necessarily countering the exact script from Section A, but rather building a toolkit to harden your own system.

UI in Colab

• Defense Buttons:

  • "Check running processes for anomalies..."

  • "Monitor network connections..."

  • "Scan files for malware signatures..."

• Textarea: Selected Prompt.

• Button: Generate Code.

• Output: A Python script designed for system monitoring or defense.

Steps

1. Select a Defense Tool: Choose a tool you want to build.

   • Example: Click "Check running processes for anomalies..." to build code that lists active programs and looks for suspicious names.

   • Example: Click "Monitor network connections..." to build a handy tool that watches your ports for any unauthorized access.

2. Click "Generate Code".

3. Analyze the Result:

   • Look at the code. It is more likely to use libraries like psutil or scapy.

   • Observation: You have effectively "generated" your own custom piece of security software. This shows that while AI empowers attackers, it also empowers defenders to create protection tools without needing needing to purchase antivirus.

Expected Observation

This lab illustrates the "Cyber-AI Arms Race." In truth, the technology is neutral; it simply accelerates code generation.

• Red Team: Shows how easily a novice can generate snippets of dangerous code (Keyloggers, Ransomware logic).

• Blue Team: Shows how easily a novice can generate powerful defense tools (Network Scanners, Process Monitors).

• Conclusion: The future of cybersecurity revolves around using AI to counteract AI threats.

👉 Click here to see the result of each scenario (Post-Lab)