Cross-Domain Data Filtering with Machine Learning Classifiers
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cross-domain solutions are less effective in detecting sophisticated malware and covert channels due to their reliance on signature-based approaches, which require frequent updates and fail to identify zero-day attacks.
Innovation Solution
Implementing a machine learning-based malicious content detection approach that uses multiple classifiers trained with labeled data, including both publicly identified and domain-specific malware, to filter data across security domains, combined with traditional filtering methods for redundant and independent verification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based detection is used, then known malware can be detected, but zero-day attacks and sophisticated malware cannot be detected
Solution Approach 1:
The system performs preliminary machine learning training with domain-specific malware samples before deployment. This pre-training enables the classifier to recognize domain-specific attack patterns and zero-day threats before they encounter the cross-domain solution, overcoming the limitation of signature-based detection that only identifies known threats.
Solution Approach 2:
The patent replaces the mechanical signature-matching system with a machine learning-based classification system. Instead of comparing file signatures against a database of known malware signatures, the system uses trained machine learning classifiers to analyze and classify files, enabling detection of novel and domain-specific threats that lack existing signatures.
2Reliability
If virus definition updates are performed frequently, then detection accuracy improves, but update cycles in classified environments are longer than desired
Solution Approach 1:
The system performs preliminary machine learning training with domain-specific malware samples before deployment. This pre-training enables the classifier to recognize domain-specific attack patterns and zero-day threats before they encounter the cross-domain solution, overcoming the limitation of signature-based detection that only identifies known threats.
Solution Approach 2:
The machine learning model is trained offline with domain-specific malware samples and then deployed for autonomous classification. Once trained, the system can independently detect novel and domain-specific threats without requiring frequent updates, as the trained model generalizes to unseen threats within the domain.
3Reliability
If multiple machine learning classifiers are used, then detection capability against diverse threats improves, but system complexity increases
Solution Approach 1:
The system segments the detection task by deploying different machine learning classifiers at different domains (source domain and destination domain). Each classifier is trained with domain-specific malware samples, allowing specialized detection for each domain while maintaining overall system manageability through modular deployment.
Solution Approach 2:
The machine learning classifiers serve multiple functions: they detect known malware, identify zero-day threats, and recognize domain-specific attack patterns. This multi-functionality reduces the need for separate specialized systems while maintaining comprehensive detection capability across diverse threat types.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Techniques for transferring data from a first domain to a second domain in a cross-domain environment are presented. The techniques can include accepting computer readable data in the first domain for transfer to the second domain, passing the computer readable data to a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious, passing the computer readable data to a second machine learning classifier at the first domain trained with at least malware files specific to the first domain, and transferring the computer readable data to a destination in the second domain.