Alert Classification via Dissimilarity Thresholds

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current network monitoring systems face issues with presenting alerts to operators effectively, as they often present false negatives due to random extraction methods unrelated to machine learning similarity, leading to improper alerts being presented.

Innovation Solution

An information processing device that calculates dissimilarity between alerts, generates a classifier using machine learning, and determines whether to present alerts based on classification results and dissimilarity thresholds, ensuring only relevant alerts are presented to operators.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If random extraction method is used to present alerts to operators, then the system can reduce false negatives by extracting alerts partially, but it leads to presenting improper alerts because the extraction is unrelated to machine learning similarity

Engineering Contradiction:

Improvealert classification accuracyVSAvoidalert presentation appropriateness

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system uses dissimilarity calculation to measure the difference between new alerts and learned alert patterns, creating a feedback loop where the machine learning model continuously refines its understanding of legitimate versus false alerts based on dissimilarity metrics, thereby improving both classification accuracy and presentation appropriateness

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The patent changes the parameter used for alert extraction from random selection to dissimilarity-based selection. By calculating dissimilarity between new alerts and learned samples, the system dynamically adjusts which alerts are presented to operators, ensuring that alerts with characteristics different from learned patterns (potential false negatives) are prioritized while maintaining high classification accuracy

Inventive Principle:

Principle #35Parameter changes

2Reliability

If machine learning is applied to classify alerts, then false positives can be reduced, but false negatives may occur when alerts have low similarity to learning samples

Engineering Contradiction:

Improvefalse positive reductionVSAvoidfalse negative detection

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

Instead of only presenting alerts that the machine learning model is uncertain about (the conventional approach), the system inverts the logic by presenting alerts that have low dissimilarity to learned samples, which are likely false negatives that the model missed. This inversion strategy complements the machine learning classification by targeting different types of alerts for operator review

Inventive Principle:

Principle #13The other way round (Inversion)

Solution Approach 2:

The system presents a selective subset of alerts to operators based on dissimilarity thresholds rather than all alerts or randomly selected alerts. This partial action approach focuses operator attention on the most critical alerts that differ from learned patterns, improving measurement precision for false negative detection without overwhelming operators with all possible alerts

Inventive Principle:

Principle #16Partial or excessive action

3Reliability

If all alerts are presented to operators for review, then classification accuracy can be maintained, but operator workload increases significantly

Engineering Contradiction:

Improveclassification accuracyVSAvoidoperator processing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system extracts and presents only the subset of alerts that have low dissimilarity to learned samples, separating these critical alerts from the bulk of alerts that can be handled automatically by the machine learning model. This extraction approach maintains classification accuracy by focusing operator review on the most important cases while reducing overall operator workload

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

Instead of presenting all alerts to operators, the system applies partial action by selecting only those alerts that meet specific dissimilarity criteria. This selective presentation maintains sufficient classification accuracy while significantly reducing operator processing time and workload

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11057399B2Information processing device, information processing system, information processing method, and storage medium for intrusion detection by applying machine learning to dissimilarity calculations for intrusion alerts

Publication Date: 2021.07.06 NEC CORP

AI summary

An information processing device according to the present invention includes: a dissimilarity calculator that calculates dissimilarity that is a distance between already received first alert information, and newly received second alert information; a machine learning generator that generates a classifier by applying machine learning to the first alert information, and determines a classification result by applying the classifier to the second alert information; and a determiner that sets the determination result and information indicating that presentation is unnecessary for the second alert information, when the determination result is false detection and the dissimilarity is less than a threshold value, and sets information indicating that presentation is necessary for the second alert information, when the determination result is true detection, or when the determination result is false detection and the dissimilarity is equal to or more than a threshold value.