Genetic Programming for Dynamic Cybersecurity Feature Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity systems rely heavily on manual effort and static machine learning models that fail to effectively identify and prevent a broad spectrum of threats due to their reliance on a fixed set of features, which are not adaptable to different types of attacks and their varying feature weightings.
Innovation Solution
The method involves identifying and modifying feature subsets using genetic programming techniques, scoring them with trained machine learning models, and selecting the best subsets to train a dynamic type classifier, allowing for real-time application of the most accurate model based on the threat's region in the feature space.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a static set of features is used in machine learning models for threat detection, then the model can be trained and deployed efficiently, but the model fails to perform adequately across the broad spectrum of threats with different feature weightings
Solution Approach 1:
The patent segments the feature space into multiple distinct regions, each characterized by specific feature weightings relevant to particular threat types. Instead of using a single static feature set for all threats, the system divides the comprehensive feature space into specialized segments that can be dynamically selected based on the threat being analyzed.
Solution Approach 2:
The patent implements dynamic feature selection by training multiple machine learning models, each specialized for a specific region of the feature space. The system dynamically selects which model to use based on the characteristics of the input threat, allowing the feature weighting to adapt dynamically rather than remaining static.
2Measurement precision
If manual effort is used to identify threats in conventional security systems, then specific threats can be analyzed in detail, but the process is inefficient and cannot handle the broad spectrum of threats
Solution Approach 1:
The patent implements automated threat disposition through machine learning models that self-service the analysis process. The system automatically identifies threats, selects appropriate feature subsets, and classifies threats without requiring manual analyst intervention for each threat, thereby maintaining high accuracy while dramatically improving throughput.
Solution Approach 2:
The patent changes the parameters of the analysis system by using different feature weightings and model configurations for different threat types. Instead of a fixed manual process, the system dynamically adjusts parameters such as feature importance and model selection based on the specific threat characteristics, enabling both speed and accuracy.
3Measurement precision
If multiple threat classifiers are trained on different feature subsets using genetic programming, then the accuracy for specific threat types improves, but the system complexity increases
Solution Approach 1:
The patent creates a universal framework where multiple threat classifiers share a common architecture and training methodology through genetic programming. While each classifier is specialized for a particular region of the feature space, they all follow the same systematic approach to feature selection and model training, providing universality in the methodology while allowing specialization in the specific models.
Data Source
AI summary
Techniques for improved cybersecurity are provided. A plurality of feature subsets are identified, each containing a respective subset of features from a plurality of features included in a set of training security logs. The plurality of feature subsets is modified using one or more genetic programming techniques, and each of the plurality of feature subsets is scored using a plurality of threat classifiers, where the plurality of threat classifiers comprise trained machine learning models. A set of feature subsets is selected, from the plurality of feature subsets, based on the scores. A type classifier is trained based on the set of feature subsets, where the type classifier comprises a trained machine learning model.