Gated Multi-Encoder Transaction Detection for Imbalanced Attack Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing rule-based methods for detecting enumeration and account-testing attacks are ineffective in identifying patterns early and are easily evaded by attackers, requiring significant transaction history and delayed rule updates, while conventional machine learning classifiers struggle with imbalanced training data in distinguishing normal and attack transactions.
Innovation Solution
A gated multi-encoder machine learning model using generative units trained on normal and attack data, combined with a multi-label classifier, to quickly identify transactions as normal, attack, or uncertain, effectively utilizing unlabeled data and imbalanced training sets.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of manufacture
If rule-based methods are used for detecting attacks, then implementation is simple, but detection accuracy and timeliness deteriorate due to delayed pattern recognition and rule updates
Solution Approach 1:
The patent replaces rule-based mechanical detection systems with a machine learning-based intelligent detection system. The machine learning model automatically learns attack patterns from transaction data, eliminating the need for manual rule creation and updating, thereby improving detection accuracy while maintaining implementation simplicity through automated processing.
Solution Approach 2:
The machine learning model performs self-learning and self-updating by automatically analyzing transaction patterns and adapting to new attack methods. This self-service capability eliminates the need for external rule updates and enables continuous improvement of detection accuracy without manual intervention.
2Device complexity
If rule-based detection is used, then system complexity is low, but response time worsens due to delayed pattern detection and rule implementation
Solution Approach 1:
The machine learning model continuously processes transaction data in real-time, maintaining constant detection readiness. This continuous action eliminates detection delays associated with rule updates, enabling immediate response to attacks while the system operates at consistent complexity levels.
Solution Approach 2:
The model performs preliminary learning and pattern recognition during normal operation, preparing detection capabilities in advance. This preliminary action ensures rapid response to attacks without the delays inherent in rule-based systems that require pattern recognition and rule implementation steps.
3Measurement precision
If conventional machine learning classifiers are used, then detection capability improves, but performance deteriorates due to struggle with imbalanced training data
Solution Approach 1:
The patent modifies the training data parameters by applying techniques to handle class imbalance, such as weighting classes or sampling methods. This parameter change enables the machine learning model to reliably detect attacks even when training data is imbalanced, improving both detection capability and performance reliability.
Solution Approach 2:
The system incorporates feedback mechanisms that continuously monitor detection performance and adjust the model accordingly. This feedback loop enables the model to learn from detection results and improve its performance on imbalanced data, ensuring reliable attack detection while maintaining improved capability.
4Measurement precision
If extensive transaction history is required for pattern detection, then detection accuracy improves, but processing efficiency worsens due to increased data volume requirements
Solution Approach 1:
The machine learning model extracts and focuses on the most relevant features and patterns from transaction data, eliminating the need to process entire transaction histories. This extraction capability maintains detection accuracy by concentrating on critical patterns while significantly improving processing efficiency by reducing the data volume required for analysis.
Data Source
AI summary
Machine learning techniques can be applied to distinguish attacks (including enumeration attacks and account-testing attacks) from normal transaction activity. An ensemble machine learning model can include at least two generative units, one of which is trained using normal transaction data and another of which is trained using attack transaction data. Each generative unit produces a reconstructed output from a given input in a manner that reflects latent patterns in either normal or attack transactions. The reconstructed outputs and the original transaction data can be provided to as inputs to a machine learning classifier, such as a multi-label (or multi-class) classifier, that determines probability scores to different transaction types (or labels), including a first label indicating normal transactions, a second label indicating attack transactions, or a third label indicating uncertain transaction type. Based on the probability scores, the transaction can be classified as normal or attack type.