AI Event Data Labeling for Fileless Attack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The scarcity of labeled data and the reliance on human expertise hinder the development of effective Machine Learning (ML) models for detecting fileless cybersecurity attacks, particularly in entities or events associated with command lines or process trees, due to the complexity and similarity of these data types, which require deep understanding and interpretation.
Innovation Solution
A workflow combining unsupervised Machine Learning, Large Language Model (LLM) artificial neural networks, and supervised or rule-based approaches to automate the labeling of command lines and process trees, reducing labeling costs and enabling the creation of labeled corpora at scale.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human experts manually label event data, then labeling accuracy is improved, but productivity deteriorates
Solution Approach 1:
The patent introduces an unsupervised machine learning model as an intermediary that automatically clusters event data and generates candidate labels, reducing the need for direct human expertise while maintaining labeling quality. The system processes event data through automated clustering algorithms that group similar events, then applies supervised or rule-based approaches to generate labels, with human experts only needing to review and validate results rather than create labels from scratch.
2Reliability
If more labeled data is collected, then ML model performance is improved, but loss of time increases
Solution Approach 1:
The system performs preliminary clustering and candidate label generation using unsupervised machine learning models before final label assignment. By pre-processing event data into clusters and generating candidate labels automatically, the system prepares the data in advance, reducing the time needed for subsequent labeling and enabling faster ML model training without sacrificing data quality or quantity.
3Productivity
If automated labeling is implemented, then productivity is improved, but measurement precision deteriorates
Solution Approach 1:
The system implements self-service through automated clustering and candidate label generation using unsupervised machine learning models. The algorithm autonomously processes event data, identifies patterns, and generates labels without requiring constant human intervention. This self-service capability maintains high productivity while preserving accuracy through the systematic application of clustering algorithms and rule-based validation.
Solution Approach 2:
The system incorporates feedback mechanisms where generated labels are validated and refined through supervised approaches and rule-based verification. Human experts review and correct labels when necessary, creating a feedback loop that continuously improves labeling accuracy while maintaining automated processing throughput. This feedback-driven approach ensures that automated labeling does not sacrifice precision for speed.
Data Source
AI summary
A computer-implemented method for a digital security system receives unlabeled event data associated with a computing environment, clusters via an unsupervised machine learning model the unlabeled event data into clusters of unlabeled event data where unlabeled event data in one cluster are more similar to each other than to unlabeled event data in other clusters, selects a respective subset of unlabeled event data for each cluster of unlabeled event data, translates via a large language model artificial neural network each unlabeled event datum in each respective subset of unlabeled event data into a description for the unlabeled event datum, and applies a label via a labeling algorithm to at least one unlabeled event datum in a respective cluster responsive to and representative of the respective description for the unlabeled event datum in the respective subset, thereby transforming the at least one unlabeled event datum to a labeled event datum.