Active Learning MITM Detection Clustering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Complex computing networks are susceptible to man-in-the-middle (MITM) attacks, which can go unnoticed for long periods, allowing attackers to access sensitive information, due to their complexity and the difficulty in detecting unauthorized data interceptions.
Innovation Solution
Active learning is employed to detect MITM attacks by grouping data traffic samples into clusters based on similarity metrics, labeling them, and training machine learning models to determine the likelihood of future interceptions, minimizing the need for human-labeled data through interactive querying and semi-supervised learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If manual labeling of data samples is used to train detection models, then detection accuracy improves, but time consumption and cost increase significantly
Solution Approach 1:
The system performs self-labeling by automatically generating labels through clustering algorithms and uncertainty sampling, eliminating the need for extensive manual human labeling while maintaining high detection accuracy for MITM attacks
Solution Approach 2:
The system pre-processes and clusters data samples before formal model training, organizing unlabeled data into structured groups that can be efficiently labeled or directly used for training, reducing the time required during the actual training phase
2Measurement precision
If more data samples are collected for training, then model accuracy improves, but data processing complexity and computational resources increase
Solution Approach 1:
The system segments the large dataset into multiple clusters based on similarity metrics, allowing the model to learn from structured, organized groups of data rather than processing raw unstructured data, which reduces computational complexity while maintaining accuracy
Solution Approach 2:
The system transforms raw network traffic data into clustered representations with assigned labels, changing the parameter space from raw packets to structured cluster profiles, which simplifies processing while preserving critical attack characteristics
3Reliability
If traditional supervised learning is used requiring fully labeled data, then model reliability improves, but the cost and time for data preparation increases
Solution Approach 1:
The system automatically generates training labels through clustering and uncertainty sampling mechanisms, making the data preparation process self-sufficient without requiring extensive manual annotation while maintaining model reliability through systematic label assignment
Solution Approach 2:
The system uses partial labeling of clustered data rather than requiring complete manual labeling of all samples, leveraging the clustered structure to infer labels for remaining samples, which reduces preparation effort while maintaining sufficient model reliability
Data Source
AI summary
Data is received that includes a plurality of samples that each characterize interception of data traffic to a computing device over a network. Thereafter, the plurality of samples characterizing the interception of data traffic are grouped into a plurality of clusters. At least a portion of the samples are labeled to characterize a likelihood of each such sample as relating to an unauthorized interception of data traffic. Each cluster is assigned with a label corresponding to a majority of samples within such cluster. At least one machine learning model is trained using the assigned labeled clusters such that, once trained, the at least one machine learning model determines a likelihood of future samples as relating to an unauthorized interception of data traffic to a corresponding computing device.