User Behavior Profile Classification for Infection Risk Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional security systems are unable to effectively determine the infection risk of computing devices that have not exhibited known malicious behaviors, leaving them vulnerable to malware infections.
Innovation Solution
A computer-implemented method that collects user-behavior profiles, trains a classification model to distinguish between infected and clean profiles, and uses pseudo-labeling to predict infection risks for unlabeled profiles, enabling the evaluation of infection likelihood based on potentially malicious behaviors.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional security systems only monitor known malicious behaviors, then false positives are reduced, but detection capability for unknown malware is insufficient
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing user behavior data before malware infection occurs. It builds behavioral profiles and trains classification models in advance on labeled data (both infected and clean profiles), enabling the system to predict infection risks proactively rather than reactively. This allows detection of potentially malicious behaviors that precede actual malware execution.
Solution Approach 2:
The system introduces an intermediary classification model that bridges the gap between known malicious behaviors and unknown threats. This model uses pseudo-labeled data to learn patterns of potentially malicious behaviors, acting as a mediator that translates subtle behavioral indicators into infection risk predictions, thereby expanding detection capability beyond traditional signature-based methods.
2Adaptability or versatility
If security systems evaluate all user behaviors, then detection coverage improves, but system complexity increases
Solution Approach 1:
The system applies partial action by focusing evaluation on specific behavioral features rather than all possible user actions. It collects behavioral data across multiple dimensions (applications used, files accessed, network connections) but selectively processes features most indicative of malware behavior. The classification model evaluates profiles at appropriate granularities, avoiding unnecessary complexity while maintaining comprehensive coverage of relevant behaviors.
Solution Approach 2:
The system segments the evaluation process into distinct components: data collection, profile generation, labeling (including pseudo-labeling), and risk prediction. Each component handles specific tasks independently, allowing the system to manage complexity through modular architecture. Behavioral profiles are segmented into discrete features that can be processed and evaluated separately by the classification model.
3Measurement precision
If pseudo-labeling is used to expand training data, then model accuracy improves, but risk of propagating errors increases
Solution Approach 1:
The system implements feedback mechanisms where the classification model's predictions are continuously evaluated and used to refine pseudo-labeling. Models are retrained iteratively with updated pseudo-labeled data, and performance is monitored to detect when error propagation occurs. This feedback loop allows the system to maintain high accuracy while managing the risks of pseudo-labeling through continuous validation and adjustment.
Data Source
AI summary
The disclosed computer-implemented method for evaluating infection risks based on profiled user behaviors may include (1) collecting user-behavior profiles that may include labeled profiles (e.g., infected profiles and/or clean profiles) and/or unlabeled profiles, (2) training a classification model to distinguish infected profiles from clean profiles using features and labels of the user-behavior profiles, and (3) using the classification model to predict (a) a likelihood that a computing system of a user will become infected based on a profile of user behaviors of the user and/or (b) a likelihood that a user behavior in the user-behavior profiles will result in a computing-system infection. Various other methods, systems, and computer-readable media are also disclosed.