Graph Convolutional Neural Network for Cyber Threat Maliciousness Estimation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for estimating maliciousness of cyber threat intelligence are not highly accurate, limiting the effectiveness of security operations.
Innovation Solution
An estimation device that collects related information, generates features, and uses a graph convolutional neural network to estimate maliciousness based on the graph structure between cyber threat intelligence, or employs a predetermined model for independent intelligence, enhancing accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If conventional graph analysis methods (PageRank, graph propagation) are used to estimate maliciousness, then the estimation process can be performed, but the accuracy of maliciousness estimation is not high because features of cyber threat intelligence cannot be used
Solution Approach 1:
The patent transforms the estimation approach by changing the parameters from conventional graph metrics to neural network-based feature representations. The graph convolutional neural network learns optimal parameter transformations from training data, enabling accurate maliciousness estimation by utilizing features of cyber threat intelligence while maintaining graph structure information.
Solution Approach 2:
The patent replaces conventional mechanical graph analysis methods (PageRank, graph propagation) with a neural network-based system. This substitution enables the system to automatically learn and utilize features of cyber threat intelligence, significantly improving estimation accuracy while the modular architecture keeps implementation complexity manageable.
2Measurement precision
If features of cyber threat intelligence are utilized through graph convolutional neural network, then maliciousness estimation accuracy is improved, but the computational complexity and processing time increase
Solution Approach 1:
The patent performs preliminary actions by pre-training the graph convolutional neural network on large datasets of cyber threat intelligence. This pre-training phase extracts and stores learned features and patterns, enabling the system to perform rapid and accurate maliciousness estimation on new threats without requiring extensive real-time computation.
Solution Approach 2:
The patent segments the estimation process into distinct phases: feature extraction through graph convolution, neural network processing, and final estimation. This segmentation allows each component to be optimized independently, reducing overall processing time while maintaining high accuracy in maliciousness estimation.
3Adaptability or versatility
If graph structure information is incorporated into the estimation model, then the utilization of cyber threat intelligence relationships is improved, but the complexity of the estimation model increases
Solution Approach 1:
The patent creates a universal graph convolutional neural network model that can process various types of cyber threat intelligence relationships through a unified framework. The model handles different graph structures and feature types using the same core architecture, improving adaptability while avoiding the need for multiple specialized models.
Data Source
AI summary
An estimation device includes: a collection section configured to collect related information when cyber threat intelligence of a maliciousness estimation target is input, the related information being related to the cyber threat intelligence and other cyber threat intelligence different from the cyber threat intelligence; a feature generation section configured to generate a feature based on the related information, the feature representing a feature of the cyber threat intelligence; a graph information generation section configured to generate graph information based on the related information and the other cyber threat intelligence, the graph information indicating a graph in which each of the cyber threat intelligence and the other cyber threat intelligence is a node and a relationship between the nodes is an edge; and an estimation section configured to estimate the maliciousness of the cyber threat intelligence by a graph convolutional neural network using the feature of the cyber threat intelligence when a graph indicated by the graph information has a graph structure between the cyber threat intelligence and the other cyber threat intelligence.