Hypergraph Classification of Unknown Elements
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cybersecurity systems face challenges in determining the maliciousness of elements that are unknown to communal databases, as they lack direct community reputation and require indirect methods for assessment, especially when elements cannot be exported due to timing constraints or privacy issues.
Innovation Solution
A method using a hypergraph of neighbor elements, where a computing device scans for elements with undetermined maliciousness, generates a hypergraph of neighbor target elements, provides it to a classifier, and generates a maliciousness level profile based on the aggregation of nodes and edges in the hypergraph, allowing for classification and subsequent actions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If external reputation sources are used to determine maliciousness, then classification accuracy is improved, but elements must be previously observed and exportable which limits applicability to unknown elements
Solution Approach 1:
The patent introduces neighbor elements as intermediaries to bridge the gap between unknown elements and external reputation sources. Instead of directly querying external databases for the unknown element, the system queries neighbors of the unknown element that may be present in external databases, uses their reputation information as intermediary data, and infers the maliciousness of the original unknown element through graph-based relationships and machine learning models.
2Ease of operation
If direct external reputation queries are performed, then maliciousness determination is straightforward, but it requires elements to be observable and exportable which is not always possible due to timing constraints or privacy issues
Solution Approach 1:
The patent creates a virtual representation (hypergraph) of the element's neighborhood relationships instead of requiring the actual element to be exported. The hypergraph copies and represents the structural relationships and connections of the unknown element with its neighbors, allowing the system to perform analysis on this virtual model rather than requiring access to the original unexportable element.
3Adaptability or versatility
If graph-based methods with neighbor analysis are used, then classification of unknown elements is enabled, but system complexity increases due to hypergraph generation and iterative neighborhood crawling
Solution Approach 1:
The patent implements dynamic neighborhood crawling where the depth and scope of neighbor exploration adapt based on the specific classification task and available data. The system dynamically adjusts the hypergraph construction process, iterating through neighborhoods at different depths and selectively including neighbors based on their relevance, rather than statically defining the entire graph structure in advance.
4Loss of information
If iterative neighborhood crawling is performed to build hypergraphs, then comprehensive neighbor information is gathered, but time and computational resources are consumed
Solution Approach 1:
The patent applies partial action by performing iterative neighborhood crawling to a limited depth rather than exhaustively exploring all possible neighbors. The system gathers sufficient neighbor information from the first few layers of the hypergraph to achieve effective classification, accepting that not all distant neighbors are necessary for accurate maliciousness determination, thus reducing computational overhead while maintaining classification effectiveness.
Data Source
AI summary
Systems and methods are provided to determine a maliciousness level of an element using a hypergraph of neighbors. The method can include receiving the element; generating a hypergraph of neighbor target elements found in a database, the hypergraph comprising a set of nodes and a set of edges, wherein the set of nodes represents the neighbor target elements, and the set of edges represents connections between the neighbor target elements; classifying nodes and edges in the hypergraph; generating a maliciousness level profile for the element based on aggregation of nodes and edges in the hypergraph; linking information related to the element with the maliciousness level profile for the element; and performing an action based on a type of the element.