Condensed Local Differential Privacy for Malware Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for diagnosing malware outbreaks face challenges in privacy concerns for clients, as they require collecting sensitive data from a large population, which may not be feasible with small populations, and cannot handle non-ordinal data types such as textual data.
Innovation Solution
The use of Condensed Local Differential Privacy (CLDP) that maps non-ordinal data to ordinal data, adds noise probabilistically to preserve privacy, and aggregates data to identify security threats while allowing analysis of sequences of non-ordinal data, enabling effective diagnosis and protection even with small populations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If data is collected from a large population to diagnose malware outbreaks, then the accuracy of threat identification is improved, but privacy concerns worsen and feasibility decreases for small populations
Solution Approach 1:
The patent introduces Condensed Local Differential Privacy (CLDP) as an intermediary mechanism that enables accurate threat identification in small populations. CLDP adds carefully calibrated noise to individual data points during collection, which allows the system to preserve privacy while maintaining measurement accuracy. This mediator resolves the contradiction by making small-population diagnosis feasible without compromising privacy or accuracy significantly.
Solution Approach 2:
The patent changes the parameter of data collection by transforming raw data into different representations (e.g., ordinal encodings, aggregated statistics) before analysis. By changing how data is parameterized and processed rather than simply increasing population size, the system achieves accurate threat identification feasibility in small populations while maintaining privacy protection.
2Reliability
If sensitive data is collected from clients' computers to diagnose malware, then the ability to identify security threats is improved, but client privacy is worsened
Solution Approach 1:
CLDP serves as a privacy-preserving intermediary that sits between data collection and threat analysis. It adds noise calibrated to the specific threat detection task, allowing the system to maintain reliable security threat identification while protecting client privacy. The noise acts as a mediator that prevents direct inference of sensitive information while preserving diagnostic capability.
Solution Approach 2:
The patent applies partial differential privacy by adding noise only to specific data elements that are not strictly necessary for threat detection, or by using aggregated statistics rather than individual records. This partial action approach maintains sufficient information for security analysis while removing or obscuring personally identifiable information, thus preserving client privacy.
3Loss of information
If noise is added to data values to preserve privacy, then client privacy is improved, but the precision of individual data measurement is worsened
Solution Approach 1:
The patent merges multiple individual data points into aggregated statistics (e.g., frequency distributions, summary counts) before analysis. By combining individual measurements into collective statistics, the system maintains privacy through noise addition while recovering measurement precision at the population level, where the law of large numbers causes noise to cancel out.
Solution Approach 2:
The patent uses iterative feedback mechanisms where initial noisy measurements inform subsequent refinement steps. The system repeatedly refines its estimates by incorporating feedback from aggregated data, gradually improving measurement precision while maintaining privacy protection throughout the iterative process.
Data Source
AI summary
Identifying and protecting against computer security threats while preserving privacy of individual client devices using condensed local differential privacy (CLDP). In one embodiment, a method may include mapping non-ordinal data values to ordinal data values, generating a first ordering scheme for the ordinal data values, accessing actual non-ordinal data values, converting the actual non-ordinal data values to actual ordinal data values according to the mapping, generating first perturbed ordinal data values by adding noise, and aggregating the first perturbed ordinal data values. The method may also include generating a second ordering scheme for the ordinal data values by denoising and refining the aggregated first perturbed ordinal data values, generating second perturbed ordinal data values by adding noise, aggregating the second perturbed ordinal data values, analyzing the aggregated second perturbed ordinal data values to identify a computer security threat, and in response, thwarting the computer security threat.