Hierarchical Network Entity Classification for Imbalanced Labels
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security systems face challenges in accurately classifying diverse and numerous network-connected devices due to imbalanced labels, hierarchical labels, and discrepancies in property distribution, leading to resource-intensive and inaccurate classifications.
Innovation Solution
The use of multiple models with varying levels of granularity, organized in a hierarchical taxonomy, to perform stage-wise classification decisions, leveraging domain knowledge and optimizing feature extraction to improve accuracy and resource efficiency.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If multiple separate classification models are trained for different granularities, then each model can be optimized for its specific task, but the training process becomes time-consuming and resource-intensive
Solution Approach 1:
The patent combines multiple classification tasks of different granularities into a single unified model. The model architecture integrates fine-grained and coarse-grained classification capabilities, allowing simultaneous training on multiple datasets. This merging approach maintains high classification accuracy for both granularities while reducing training time and computational resources compared to training separate models independently.
Solution Approach 2:
The unified classification model is designed to perform multiple classification functions simultaneously - both fine-grained classification and coarse-grained classification. The model accepts multiple datasets as input and produces multiple classification outputs, making it a universal solution that replaces multiple specialized models with a single multi-functional system.
2Measurement precision
If multiple separate classification models are trained for different granularities, then each model can be optimized for its specific task, but the overall system complexity increases
Solution Approach 1:
By merging multiple classification models into a single unified model, the patent reduces system complexity. Instead of maintaining, deploying, and managing multiple separate models, the system uses one integrated model that handles both fine-grained and coarse-grained classification, simplifying the overall architecture and reducing operational complexity.
Solution Approach 2:
The unified model serves as a universal classifier that can handle different classification granularities through a single interface. This multi-functionality eliminates the need for complex model selection logic and simplifies the system architecture by replacing multiple specialized components with one versatile component.
3Loss of time
If a single unified model is used for multiple granularities, then training time is reduced, but the model may struggle to capture fine-grained details effectively
Solution Approach 1:
The unified model architecture is segmented to handle different granularities effectively. The model processes datasets in a structured manner, with specific layers and mechanisms dedicated to capturing fine-grained features while maintaining coarse-grained classification capabilities. This segmentation allows the model to preserve fine-grained details without compromising overall training efficiency.
Solution Approach 2:
Different parts of the unified model are optimized for different classification granularities. Specific components of the model architecture are designed with local quality enhancements to capture fine-grained details, while other components handle coarse-grained patterns. This localized optimization ensures that fine-grained classification accuracy is maintained even within the unified model structure.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Systems, methods, and related technologies for classification are described. Network traffic from a network may be accessed and an entity may be selected. One or more values associated with one or more properties associated with the entity may be determined. The one or more values may be accessed from the network traffic. A first model associated with a first level of granularity is accessed. A first classification result of the entity based on the first model is determined by a processing device. A second model associated with a second level of granularity is accessed. The second level of granularity is higher than the first level of granularity and the second model is accessed based on the first classification result. A second classification result of the entity based on the second model is determined. At least one of the first classification result or the second classification result is stored.