Entropy-Based False Positive Mitigation in AI Cybersecurity Models
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
AI models in cybersecurity often produce false positives due to imbalanced training datasets, leading to unreliable classifications and resource wastage, and the risk of false positive floods.
Innovation Solution
An entropy-based preemptive false positive mitigation system that computes feature attribution vectors, identifies low entropy distribution samples, and constructs mitigation rules to prevent future false positives by focusing on dominant features.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If AI models are trained on imbalanced datasets to detect cybersecurity threats, then detection capability is improved, but false positive rate increases
Solution Approach 1:
The system performs preliminary analysis by computing feature attribution vectors for training samples before model training. It identifies and excludes low-entropy distribution samples (those with concentrated feature attributions) from the training dataset, thereby preventing the model from learning biased patterns that cause false positives. This preemptive data cleaning occurs before the actual model training begins.
Solution Approach 2:
The system changes the parameter of feature attribution distribution by computing Shapley values or similar attribution methods to quantify feature importance. It then uses entropy calculation to measure the distribution of these attributions and filters samples based on their entropy values, transforming the training data from its original imbalanced state to a corrected state that reduces false positives.
2Productivity
If AI models classify samples based on dominant features, then classification speed is improved, but false positive flood risk increases
Solution Approach 1:
The system performs preliminary identification of problematic features and samples before classification occurs. By computing feature attribution vectors and calculating entropy for all training samples upfront, it pre-determines which features and samples are problematic. This allows the model to avoid making incorrect classifications during actual operation, preventing false positive floods before they occur.
Solution Approach 2:
The system incorporates feedback from analyzing feature attribution distributions to adjust the training process. By monitoring the entropy of feature attributions and using this information to filter training data, it creates a feedback loop that continuously improves the model's ability to distinguish true positives from false positives, thereby reducing false positive floods.
Data Source
AI summary
The present disclosure provides an approach of computing a plurality of feature attribution vectors from a plurality of samples. The approach determines a plurality of low entropy distribution samples from the plurality of samples based on the plurality of feature attribution vectors, and determines a feature value distribution corresponding to the plurality of low entropy distribution samples. Then, the approach identifies a false positive candidate sample based on the feature value distribution and, in turn, constructs a mitigation rule, based on the false positive candidate sample, to mitigate a future false positive sample.