Decision Validation Model for Secure AI Malware Prediction Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Security software using artificial intelligence/machine learning for malware detection often generates false positive or false negative predictions, which can impair device security and introduce risks when updating models to correct these predictions.
Innovation Solution
Implementing a decision validation model that is non-executable and trained by a remote security service to correct false predictions made by prediction models, using input vectors and decision values to output revised confidence levels or decisions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If security software updates (patches) are distributed to correct false predictions, then prediction accuracy is improved, but security risks increase due to malware pretending to be legitimate updates
Solution Approach 1:
The patent creates a data-only copy of the prediction model (decision validation model) that contains updated prediction logic without including executable code. This copy is used to update predictions without distributing traditional executable patches, thereby maintaining accuracy improvements while eliminating the security vulnerability of executable update distribution
Solution Approach 2:
The patent extracts the predictive decision-making logic from the executable security software and separates it into a standalone data-only decision validation model. This extraction allows the prediction accuracy to be updated independently without distributing executable code, thus resolving the contradiction between improving predictions and reducing security risks
2Reliability
If traditional executable patches are used to update prediction models, then false predictions are corrected, but the update process itself introduces security vulnerabilities
Solution Approach 1:
Instead of distributing executable patch files that could be malicious, the system distributes a data-only copy (decision validation model) containing the corrected prediction logic. This copy can be applied to update predictions without executing external code, thereby improving reliability while eliminating the security vulnerability inherent in traditional executable patch distribution
Solution Approach 2:
The patent introduces a data-only decision validation model as an intermediary between the original prediction model and the execution environment. This intermediary contains the corrected logic and updates predictions without requiring executable patch installation, thus improving reliability while avoiding the security risks of executable updates
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A security agent configured to utilize a decision validation model for a prediction model of a security agent of the computing device is described herein. The decision validation model includes non-executable data and is utilized by a function of the security agent along with the input vector and decision value of the prediction model as inputs to the decision validation model. The decision validation model then outputs a different decision value from the decision value of the prediction model. The security agent receives the decision validation model from a security service that trains the decision validation model when the prediction model is generating false predictions.