Cross-Device Feature Selection for Robust Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing AI-based computer security systems face challenges in selecting robust input features that reliably differentiate between malicious and benign software across heterogeneous devices, with conventional methods either increasing feature count or using uninformative self-generated features, leading to inefficiencies and high training costs.
Innovation Solution
A method for selecting a reduced subset of features by dividing data samples into training corpora, analyzing frequency distributions across corpora, and determining similarity between these distributions to identify robust features, which are then used to train a threat detector.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the count of features is substantially increased to improve detection performance across heterogeneous devices, then the ability to differentiate between malicious and benign samples improves, but the cost of implementing and training the AI model increases significantly
Solution Approach 1:
The patent extracts and removes irrelevant or redundant features from the feature set through a selection process. By dividing training data into multiple corpora and analyzing feature frequency distributions across these corpora, the system identifies and retains only the most informative features, thereby reducing model complexity while preserving detection performance.
Solution Approach 2:
The patent changes the parameter of feature selection by using frequency distribution analysis across multiple training corpora. Instead of using all available features or relying on unsupervised feature construction, the system evaluates features based on their frequency distributions and selects those that show consistent discriminative power across different data corpora, optimizing the balance between performance and complexity.
2Adaptability or versatility
If unsupervised training is used to construct features automatically, then the system can adapt to different devices without manual feature engineering, but the generated features become uninformative to human users and may not perform well on unseen data
Solution Approach 1:
The patent segments the training data into multiple distinct corpora, each representing different devices or data sources. By analyzing feature frequency distributions across these segmented corpora separately, the system identifies features that are both adaptive to device variations and maintain interpretability, as the segmentation allows for systematic evaluation of feature relevance across different contexts.
Solution Approach 2:
The patent implements a feedback mechanism where feature frequency distributions are analyzed across multiple corpora to evaluate feature quality. This feedback loop allows the system to select features that demonstrate consistent discriminative power across different devices while maintaining interpretability, as the feedback from multiple corpora analysis provides information about both adaptability and feature meaningfulness.
3Measurement precision
If a large number of features are used to capture malware variability, then detection accuracy improves, but the training data requirements and training costs increase
Solution Approach 1:
The patent extracts only the most informative features by analyzing frequency distributions across multiple training corpora. This extraction process identifies a reduced subset of features that capture the essential variability of malware behavior across different devices, thereby maintaining detection accuracy while reducing the amount of training data and computational resources required.
Solution Approach 2:
The patent changes the approach to feature selection by using frequency distribution analysis as a filtering criterion. This parameter change allows the system to identify a compact set of high-value features that provide sufficient detection accuracy with reduced training data requirements, as the frequency analysis efficiently distinguishes informative features from redundant ones.
Data Source
AI summary
A diverse collection of data samples harvested for computer security applications is divided into a plurality of training corpora according to criteria such as an identity of the data source, among others. An initial set of features for characterizing the collected data samples is reduced to an optimal subset. For each candidate feature, a frequency distribution of feature values is determined over each of the training corpora. A feature selection procedure favors features whose frequency distribution is relatively similar across multiple corpora. A detector module is then trained to detect computer security threats according to the reduced set of features.