Dynamic Feature Selection for Cybersecurity Threat Disposition
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current security threat disposition methods are inefficient due to the manual and time-consuming process of analyzing vast amounts of data, leading to challenges in accurately identifying and responding to security alerts, as human analysts struggle to handle the high volume of alerts and false positives, and existing machine learning models may not perform optimally across all types of security risks.
Innovation Solution
A method for dynamically selecting features and machine learning models by training a base model, determining feature impacts, creating subsets, and training multiple models on these subsets to optimize predictions for specific security risks, allowing for the selection of the most relevant features and models for each incoming data instance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple machine learning models are trained on different feature subsets, then predictive accuracy for specific security risks is improved, but model selection complexity increases
Solution Approach 1:
The patent segments the feature space into multiple subsets, each optimized for specific types of security risks. Instead of using all features for all models, the system divides features into targeted groups and trains specialized models on each subset. This segmentation allows each model to focus on relevant features for its specific security domain, improving accuracy while the automated selection process manages the complexity of having multiple models.
Solution Approach 2:
The system dynamically changes the parameter configuration by selecting different feature subsets for different security risk types. The model selector adjusts which features are active based on the specific security context, effectively changing the input parameters for each prediction task. This allows optimal model-performance matching without requiring manual configuration of complex model ensembles.
2Reliability
If manual analysis processes are used to review security alerts, then thorough investigation is achieved, but time consumption increases
Solution Approach 1:
The patent replaces the mechanical manual analysis process with an automated machine learning system. The ML models perform the investigative analysis that previously required human analysts to manually examine features and data. The system automatically selects appropriate models and features, executes predictions, and generates dispositions, substituting human mechanical analysis with automated computational processes that maintain thoroughness while dramatically reducing time consumption.
3Device complexity
If a single machine learning model is used for all security alerts, then system simplicity is maintained, but prediction accuracy for diverse threats decreases
Solution Approach 1:
The patent introduces dynamics into the system by implementing an automated model selection mechanism that adapts to different security contexts. Instead of a static single-model approach, the system dynamically selects from multiple pre-trained models based on the specific characteristics of each security alert. This dynamic adaptation allows the system to maintain simplicity from the user perspective while internally optimizing for accuracy by choosing the most appropriate model for each case.
Data Source
AI summary
An apparatus, a method, and a computer program product are provided that dynamically selects features and machine learning models for optimal accuracy when determining a threat disposition of a security alert. The method includes training a base machine learning model, determining impacts that features in the training dataset have on the trained base machine learning model when predicting threat disposition on security threats, and creating subsets of the features, based on threat dispositions, by analyzing the features with their corresponding impacts and placing common features and impacts into each subset of the subsets. The method also includes training a plurality of machine learning models and a machine learning feature predictor using the training dataset and the subsets. The method further includes selecting, for a new input data instance, the selected features from the new input data instance and selecting a trained machine learning model trained based on the selected features.