Ensemble Model for Malicious Communication Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods face challenges in accurately specifying malignant communication destinations as attackers frequently change these, leading to inadequate model accuracy due to insufficient training data.
Innovation Solution
A calculation device and method that generates a mixed model by weighting and combining multiple training models, using ensemble learning to improve the accuracy of malignant degree calculations for communication destinations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a model is generated using only the latest malignant communication destination data, then the model can be updated quickly to reflect current threats, but the model accuracy is insufficient due to lack of sufficient training information
Solution Approach 1:
The system maintains a time-series database of historical malignant communication destination data, performing preliminary data collection and storage across multiple time points. This allows the model to access sufficient training information from past data without requiring real-time updates, thereby maintaining accuracy while avoiding the time loss of continuous model retraining.
Solution Approach 2:
The system combines multiple data sets from different time periods into a comprehensive training data set. By merging historical data with current data, the model receives sufficient training information across various time points, improving accuracy without relying solely on the latest data which may be insufficient on its own.
2Measurement precision
If multiple models are trained on different data sets, then the model accuracy improves through ensemble learning, but the system complexity increases
Solution Approach 1:
The system divides the training data into multiple time-based data sets (first time period, second time period, etc.) and generates separate models for each. This segmentation allows each model to specialize in specific time period characteristics, improving overall measurement precision while maintaining manageable individual model complexity.
Solution Approach 2:
The system creates a universal evaluation mechanism that can handle multiple models generated from different data sets. The malignant degree calculation unit universally evaluates communication destinations by synthesizing results from multiple models, achieving high precision without requiring separate evaluation systems for each model.
3Adaptability or versatility
If attackers frequently change malignant communication destinations, then the threat landscape becomes more dynamic and harder to track, but conventional single-model approaches cannot adapt quickly enough
Solution Approach 1:
The system implements a dynamic multi-model architecture where models are trained on data from different time periods and can be selectively applied based on the characteristics of the communication destination being evaluated. This dynamic approach allows the system to adapt to changing threat patterns while maintaining detection accuracy through the collective intelligence of multiple specialized models.
Data Source
Figure 1
Figure 2
Figure 3~4
AI summary
A calculation device (10) receives input of a plurality of pieces of training data including a communication destination known to be malignant as data. The calculation device (10) generates a model that calculates a malignant degree of an input communication destination from each piece of the training data. The calculation device (10) gives weight to each of the models, and generates a mixed model using the model and the weight. The calculation device (10) calculates a malignant degree of a communication destination unknown whether the communication destination is malignant using the mixed model.