Analysis Apparatus for Cybersecurity Alert Prediction Error Extraction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing complexity and scale of monitored systems in cybersecurity environments lead to inaccurate prediction of alert importance due to high-dimensional feature values and noise in analysis results, making it difficult for Security Operation Centers (SOCs) to automate the determination of security alert importance effectively.
Innovation Solution
An analysis apparatus that calculates prediction errors and extracts error factors by correlating appearance frequencies of contributing factors, allowing for the reduction of noise and improvement in prediction accuracy through an iterative process that updates the prediction model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If the number of feature values (dimensions) is increased to capture more aspects of cyberattacks and system complexity, then the comprehensiveness of analysis is improved, but the prediction accuracy deteriorates due to noise and the curse of dimensionality
Solution Approach 1:
The patent extracts and removes noise components from high-dimensional feature values through statistical analysis. By identifying and eliminating features that contribute primarily to noise rather than signal, the system maintains comprehensive analysis coverage while improving prediction accuracy. This is achieved through analyzing the correlation between feature values and prediction errors, then selectively removing or down-weighting noisy features.
Solution Approach 2:
The patent transforms the approach by changing parameters from raw high-dimensional features to statistically processed features that have had noise removed. This involves calculating prediction errors, analyzing error distributions, and transforming original features into refined features with improved signal-to-noise ratios, thereby maintaining comprehensiveness while enhancing accuracy.
2Adaptability or versatility
If more predictor variables are added to the prediction model to account for diverse cyberattack methods, then the model's coverage is improved, but the noise in analysis results increases, leading to larger prediction errors
Solution Approach 1:
The patent performs preliminary noise removal and feature refinement before final prediction. By pre-processing the high-dimensional features to eliminate noise components and validate their predictive value, the system ensures that only reliable features are used in the prediction model. This preliminary action prevents noise from accumulating as more variables are added.
Solution Approach 2:
The patent implements a feedback mechanism where prediction errors are continuously analyzed to identify which features contribute to noise. The system uses this feedback to iteratively refine the feature set, removing or adjusting features that increase prediction error. This creates a self-correcting process that maintains model coverage while systematically reducing noise impact.
Data Source
AI summary
An analysis apparatus comprises: a processor; and a storage device that stores a prediction model that predicts results for contributing factors of a group of events, wherein the processor executes: a prediction error calculation process in which, on the basis of a first prediction value attained by providing the prediction model with a first appearance frequency for contributing factors of a first event among the group of events, and results corresponding to the first appearance frequency, a prediction error of the first prediction value is calculated; and an error factor extraction process in which, on the basis of a correlation between a second appearance frequency for a contributing factor of a second event among the group of events and the prediction error calculated by the prediction error calculation process, an error factor of the prediction error is extracted from among the contributing factors of the first event.