Digital Skimming Threat Detection with Segmented Machine Learning Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current detection solutions struggle to identify digital skimming attacks, particularly those occurring within web browsers, as malicious code can be hidden within legitimate website code, posing a challenge for financial institutions due to third-party control issues.
Innovation Solution
A threat management system utilizing large language models (LLMs) with vector databases to analyze code for malicious and threat protection indicators, preventing the implementation of malicious code and ensuring sufficient security measures are in place before deployment.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If machine learning models are trained to detect malicious code, then detection capability is improved, but system complexity increases
Solution Approach 1:
The system divides the detection task into separate specialized models: a first machine learning model for detecting malicious code and a second machine learning model for detecting threat protection code. This segmentation allows each model to be optimized for its specific function while working together to solve the overall detection problem, improving reliability without requiring a single overly complex monolithic system.
Solution Approach 2:
The system introduces a promotion rules component that acts as an intermediary between the two machine learning models and the final promotion decision. This mediator synthesizes the detection results from both models and applies business logic to make the final determination, managing system complexity by creating a clear separation of concerns between detection and decision-making components.
2Reliability
If code analysis is performed to detect malicious code, then security is improved, but processing time increases
Solution Approach 1:
The system performs preliminary detection of both malicious code and threat protection code during the development phase before promotion to production. By conducting this security analysis in advance, the system ensures security without delaying the actual promotion process, as the analysis is completed beforehand. This preliminary action allows the promotion decision to be made quickly once all checks pass.
Solution Approach 2:
The system continuously monitors and analyzes code throughout the development lifecycle, maintaining constant security surveillance. This continuous detection capability ensures that security is maintained without requiring periodic interruptions or delays, as the analysis operates continuously in the background during development and testing phases.
3Measurement precision
If detection of threat protection code is added, then accuracy is improved, but device complexity increases
Solution Approach 1:
The system segments the detection function into two independent machine learning models: one specialized for detecting malicious code and another for detecting threat protection code. This segmentation improves accuracy by allowing each model to be finely tuned for its specific detection task, while the modular architecture manages complexity by separating the detection responsibilities into distinct, manageable components.
Solution Approach 2:
The system changes the detection parameters by introducing a dual-model approach where the first model detects malicious indicators and the second model detects threat protection indicators. This parameter change in the detection strategy enables more accurate and nuanced analysis of code security status, improving measurement precision by considering multiple aspects of code security simultaneously.
Data Source
AI summary
Disclosed herein are apparatus, system, method, and computer-readable medium aspects for identifying and preventing digital skimming attacks using a machine learning model. A threat management system may crawl one or more external sources in order to obtain training data for one or more machine learning models. A plurality of different models may be used to conduct different analyses with respect to an application under test. For example, a first model may identify malicious code. A second model may detect the presence of threat protection code which may protect against skimming attacks. Depending on whether an application under test is free from malicious code and/or includes threat protection code, a threat management system may determine whether close may be promoted to a production or live environment. The threat management system may also use a third model to generate security protocol code for a developer based on learned best practices.