Cloud Threat Detection via Pre-Trained ML Model Copying
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Threat detection systems in cloud computing environments face inefficiencies when new accounts are added, as they require sufficient training data to detect anomalous activity, leading to delayed detection of malicious behavior.
Innovation Solution
The system leverages organization units (OUs) to train machine learning models centrally across multiple accounts, allowing new accounts to utilize existing models for immediate threat detection by generating a new ML model from a portion of an existing model, thereby reducing the time to detect anomalies.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If traditional threat detection systems require sufficient training data for each account, then detection accuracy is improved, but time to detect anomalies increases for new accounts
Solution Approach 1:
The system performs preliminary action by pre-training machine learning models on historical data from multiple accounts before new accounts are created. When a new account is added, the system immediately applies the pre-trained model to detect anomalies, eliminating the waiting period that would otherwise be required for the model to accumulate sufficient training data from the new account's own activity.
Solution Approach 2:
The system creates a copy of the pre-trained machine learning model and applies it to the new account. This copying approach allows the new account to benefit from the detection capabilities developed from historical data without requiring the new account to generate its own training data from scratch, thus reducing detection time while maintaining accuracy.
2Reliability
If security infrastructures are deployed at endpoints, then threat detection capability is improved, but system complexity and cost increase
Solution Approach 1:
The system replaces the mechanical approach of deploying security software agents at every endpoint with a cloud-based machine learning model that processes data centrally. This substitution eliminates the need for complex software deployment and maintenance at endpoints while maintaining effective threat detection capability through automated pattern recognition in cloud-stored data.
Solution Approach 2:
The machine learning model serves multiple accounts simultaneously, providing universal threat detection capability across the entire organization. This multi-functional approach replaces the need for separate security infrastructures at each endpoint, reducing overall system complexity while maintaining comprehensive protection.
3Measurement precision
If individual ML models are trained for each account, then detection specificity is improved, but time and computational resources increase
Solution Approach 1:
The system merges the training process by creating a single pre-trained machine learning model that incorporates historical data from multiple accounts. This unified model is then applied to all accounts, including new ones, eliminating the need to train separate models for each account and significantly reducing the time and computational resources required while maintaining high detection specificity through shared learning.
Data Source
AI summary
A first instance of an event management system monitors event data corresponding to a first group of users in a cloud computing system. Using a first machine learning (ML) algorithm, the first instance detects an anomalous event from the event data. The first ML algorithm is trained using historical event data. A second instance of the event management system is created and a copy of the first ML algorithm is added to the second instance. The second instance monitors second event data corresponding to a second group of users in the cloud computing system. Using the copy of the first ML algorithm, the second instance detects a second anomalous event from the second event data.