Behavior Data Augmentation for Gray Behavior Anomaly Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current information security systems struggle to effectively identify gray behaviors or graywares, which are suspicious but not classified as computer viruses or Trojan horse programs, leading to compromised security and inefficient verification processes in zero-trust environments.
Innovation Solution
An anomaly detection device and method utilizing data augmentation, which involves continuous data collection, activation-status determination, and mathematical combination of behavior types to generate extensive combinations for training and anomaly detection, enhancing accuracy and reducing human resource requirements.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional data collection methods are used to identify gray behaviors, then detection accuracy can be improved, but human resource requirements and data collection costs increase significantly
Solution Approach 1:
The patent creates synthetic copies of behavior data through data augmentation techniques. Instead of manually collecting diverse gray behavior data, the system generates synthetic data samples that replicate the characteristics of gray behaviors, thereby reducing the need for human resource-intensive data collection while maintaining detection accuracy
Solution Approach 2:
The patent performs data augmentation in advance to create an enriched training dataset before model training. By pre-generating synthetic gray behavior data and combining it with actual data, the system prepares a comprehensive dataset that improves detection accuracy without requiring extensive manual data collection during operation
2Reliability
If strict verification policies are implemented in zero-trust environments, then security verification can be improved, but false alert rates increase
Solution Approach 1:
The patent changes the parameters of behavior data by generating synthetic variations through data augmentation. This creates a more robust model that can distinguish between legitimate variations in behavior and actual anomalies, thereby maintaining verification reliability while reducing false alerts caused by overly strict policies
Solution Approach 2:
The system uses the augmented data to train models that provide better feedback on behavior verification. The enriched dataset enables the model to learn from diverse examples, improving its ability to accurately assess whether behavior should pass or fail verification, thus reducing false alerts
3Measurement precision
If more behavior data is collected to improve model training, then detection accuracy can be improved, but data collection time and resources increase
Solution Approach 1:
The patent generates synthetic copies of existing behavior data through augmentation techniques, creating additional training samples without requiring extended data collection periods. This approach maintains model accuracy while significantly reducing the time and resources needed for data collection
Solution Approach 2:
The system performs data augmentation as a preliminary step before model training, creating a comprehensive synthetic dataset in advance. This pre-processing approach ensures sufficient training data is available without requiring prolonged data collection during the modeling phase
Data Source
Figure 1
Figure 2~3
Figure 4
AI summary
An anomaly detection device (100) by utilizing data augmentation is disclosed, which includes a continuous data collection module (110) and a processor (120). The processor (120) executes following steps for each of collected multiple data records (d1-dM): executing an activation-status determination on multiple behavior data by utilizing corresponding activation functions with respect to multiple behavior types and generating a set of the behavior types specific to each subject; for each subject, performing data augmentation by enumerating multiple mathematical combinations of the behavior types; using outputs of the data augmentation as inputs of a learning function to train the machine learning model (BM) of baseline behavior features; and using new outputs of the data augmentation according to all new data record captured from the testing subject during a predefined time range by the continuous data collection module (110) as inputs of a predict function to perform anomaly detect.