Graph Convolution Network for Malicious Element Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Graph-based cyber-security systems face challenges in classifying elements with complex, unordered relations, particularly when using neural networks, which require structured order, and in propagating information through intricate graph structures, leading to potential errors due to intermediate element misclassification.
Innovation Solution
A directed hypergraph approach is used to classify elements based on aggregated information from close neighbors, employing a crawling procedure to collect neighborhoods and a Graph Convolution Network (GCN) architecture that operates on subgraphs, allowing for context-aware classification without intermediate element classification, thus overcoming the limitations of prior art.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If traditional neural networks are used for classifying elements in graph-based cyber-security systems, then the system can process structured ordered data, but it cannot effectively handle complex unordered relations between elements
Solution Approach 1:
The patent transitions from traditional neural networks operating on flat structured data to graph neural networks that operate on multi-dimensional graph structures with nodes and edges, enabling the system to naturally represent and process unordered relational data while maintaining computational efficiency
2Reliability
If information is propagated through intricate graph structures using intermediate element classification, then the system can process complex relations, but errors due to intermediate misclassification accumulate and reduce reliability
Solution Approach 1:
The patent extracts and processes relational information directly from the graph structure through message passing between nodes, eliminating the need for intermediate element classification steps that were causing error accumulation, while still capturing complex relational patterns
Solution Approach 2:
The graph neural network introduces a new intermediary mechanism where messages are passed directly between connected nodes through edge-based relationships, avoiding the traditional intermediary classification step and reducing error propagation while maintaining the ability to process complex relations
3Measurement precision
If prior art methods classify elements using limited feature vectors, then the process is computationally simple, but the input lacks richness and reduces measurement precision
Solution Approach 1:
The patent merges multiple feature vectors from neighboring elements along with their interconnection relationships into a unified enriched input representation, allowing the system to leverage both the richness of multiple features and the structural context of graph relationships while maintaining computational efficiency through the graph neural network architecture
Data Source
AI summary
A method of determining the level of maliciousness of an element using a directed hypergraph to classify the element based on information aggregated from its locally identified close neighbors, queried in a data base such as VirusTotal (VT). A crawling procedure is used starting from elements needing classification and collecting a set of their neighbors forming neighborhoods. These neighbors are then used to classify the elements. The neural network classifier is able to obtain as input an entire neighborhood. The input includes several feature vectors, one for each element in the neighborhood. In addition, a mapping of interconnections can be provided for each group of elements. Finally, a maliciousness level is provided for the elements in question. For an incriminated file one or more actions can be taken, such as isolating a machine that received the file, killing processes started by the file, removing persistence of the file on the network or affected computer, cleaning infected samples, modifying risk assessment for computer or network, generating a report, collecting additional artifacts, triggering a search for related elements, blocking a user from taking actions and sending information to other IT or security systems. For other element types, some of the above actions are applicable as well. In addition, there are other actions specific to particular element types, e.g. blocking an IP address or a web domain from network access, restricting user authorization, blocking access to an external device, shutting down computers, erasing memory devices, filtering e-mail messages, and many more.