Cyber-Attack Variant Detection Using Siamese Network Retraining
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cyber-attack detection systems struggle to identify and verify new variants of known threats due to evolving attack patterns, leading to ineffective ML model decay and potential network compromise.
Innovation Solution
A cyber-polymorphism system using a Siamese neural network and generative adversarial network (GAN) to validate and generate new variants of known threats, retraining the ML model with labeled network metadata to maintain detection efficacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based IDS is used to detect known attacks, then detection accuracy for known threats is improved, but ability to detect new attack variants deteriorates
Solution Approach 1:
The system dynamically transitions from static signature-based detection to dynamic anomaly-based detection using Siamese neural networks that continuously learn and adapt to new attack patterns, enabling the system to detect both known threats and emerging variants
Solution Approach 2:
The system changes the detection parameters from fixed signatures to dynamic anomaly thresholds established by Siamese neural networks, allowing the detection criteria to evolve with new attack techniques while maintaining accuracy
2Adaptability or versatility
If anomaly-based IDS is used to detect unknown attacks, then detection of new variants is improved, but detection accuracy for known threats deteriorates
Solution Approach 1:
The Siamese neural network acts as an intermediary between raw network traffic and detection decisions, providing a sophisticated feature extraction and comparison mechanism that enables both high accuracy for known threats and adaptability for new variants
Solution Approach 2:
The system incorporates feedback loops where detected anomalies and new variants are fed back into the Siamese neural network for retraining, continuously improving the model's accuracy and adaptability in an iterative process
3Productivity
If ML-based threat detection systems are used, then overall detection performance is improved, but vulnerability to evolving threats increases without regular updates
Solution Approach 1:
The system implements continuous learning through ongoing Siamese neural network training on new network metadata, ensuring the detection model continuously adapts to evolving threats without interruption or manual retraining cycles
Solution Approach 2:
The system performs self-updating through automated Siamese neural network training on newly detected anomalies and network metadata, eliminating the need for external intervention or manual model updates to maintain effectiveness against evolving threats
4Measurement precision
If extensive knowledge of security experts is required for threat modelling and signature derivation, then detection accuracy for known attacks is improved, but time consumption increases
Solution Approach 1:
The system replaces the manual mechanical process of expert threat modeling and signature derivation with an automated Siamese neural network that learns attack patterns directly from network metadata, eliminating time-consuming manual analysis while maintaining high detection accuracy
Data Source
Figure 1
Figure 2a
Figure 2b
AI summary
A computer-implemented method of operating a cyber-attack detection machine learning, 'ML', model, the computer-implemented method comprising: obtaining one or more detections of cyber-attacks output from the ML model, each such detection: being based on an input network metadata record, and having an associated confidence level; determining that one or more of the detections are associated with confidence levels below a predetermined confidence threshold; obtaining a network metadata feature set characteristic of each of one or more known categories of cyber-attack; determining that one of the detections associated with confidence levels below the predetermined confidence threshold was based on an input network metadata record whose features correspond to the network metadata feature set characteristic of one of the known categories of cyber-attack; labelling that input network metadata record as a new variant of that known category of cyber-attack; and using that labelled input network metadata record as training data to retrain the ML model.