Connection Destination Malignancy Scoring Across Time and Regions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for determining the malignancy of connection destinations in cyberattacks often fail to consider time and regional characteristics, leading to high implementation costs and reliance on individual skills, as they typically rely on single-point observations and lack continuous or multi-location monitoring.
Innovation Solution
A connection destination malignancy determination system that employs machine learning to automatically determine malignancy and countermeasure priority by observing connection destinations from multiple locations, considering time-series changes and regional differences, and providing a blocking list based on these determinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If continuous or multi-location observation is performed to accurately determine malignancy, then determination accuracy is improved, but implementation cost increases
Solution Approach 1:
The system segments the observation task by deploying multiple observation nodes at different locations to simultaneously monitor connection destinations. Each node performs localized observation and reports findings to a central determination unit, dividing the complex multi-location observation requirement into manageable independent tasks that reduce overall system complexity and cost.
Solution Approach 2:
The system adds the spatial dimension by performing observations from multiple geographic locations simultaneously. This dimensional expansion allows the system to determine malignancy based on whether connections are observable from multiple regions, providing more accurate determination without requiring continuous monitoring at each location, thus reducing implementation cost while maintaining precision.
2Measurement precision
If continuous or multi-location observation is performed to accurately determine malignancy, then determination accuracy is improved, but dependence on individual skills increases
Solution Approach 1:
The system implements automated determination logic that processes observation results from multiple locations and automatically calculates malignancy scores without requiring manual analysis. The determination unit autonomously evaluates whether connection destinations are observable from multiple regions and applies predefined criteria to generate blocking decisions, eliminating dependence on individual operator skills while maintaining high determination accuracy.
Solution Approach 2:
The system incorporates feedback mechanisms where observation results from multiple locations are continuously fed back to the determination unit, which adjusts malignancy assessments based on aggregated data. This automated feedback loop ensures consistent, skill-independent determination accuracy by systematically processing multi-location observations rather than relying on individual expert judgment.
3Reliability
If blocking list is updated with all reported malicious hosts, then security coverage is improved, but resource consumption increases
Solution Approach 1:
The system changes the parameter of malignancy determination from binary (malicious/not malicious) to a continuous score based on the number of locations from which a connection destination is observable. By calculating malignancy scores and comparing them against a threshold, the system prioritizes blocking high-scoring targets, achieving comprehensive security coverage while conserving resources by focusing efforts on the most suspicious connection destinations rather than processing all reported hosts equally.
Data Source
AI summary
A connection destination malignancy determination system connected to the Internet through a network includes: a connection destination observation unit that observes a connection destination; a connection destination malignancy determination unit that determines a malignancy indicating the degree of maliciousness of the connection destination; and a countermeasure priority determination unit that determines a countermeasure priority indicating the degree of preferential countermeasure required based on the malignancy and an observation result of the connection destination.