Locality Sensitive Hashing for Polymorphic Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Cyber-security vendors face challenges with hash-based signatures in threat detection due to perturbations introduced by malicious actors, ineffective machine learning solutions, and dimensionality issues caused by cryptographic hashes, leading to poor performance in detecting polymorphic variants.
Innovation Solution
Implementing locality sensitive hashing (LSH) algorithms like MinHash and SimHash to generate anchor points, computing Jaccard resemblance scores, and encoding feature vectors to create synthetic hashes that enhance the resilience of hash-based fingerprints for machine learning applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If cryptographic hash-based signatures are used for threat detection, then signature uniqueness is improved, but dimensionality and detection difficulty increase
Solution Approach 1:
The patent segments the high-dimensional cryptographic hash space into multiple lower-dimensional projection spaces using Locality Sensitive Hashing. Each LSH function projects the original hash features into a separate dimension, transforming the single high-dimensional signature into multiple lower-dimensional representations that are easier to analyze and detect while preserving the uniqueness property.
Solution Approach 2:
The patent applies dimensionality transformation by projecting cryptographic hash signatures from high-dimensional space into multiple lower-dimensional spaces through LSH functions. This dimensional reduction maintains the discriminative power of unique signatures while making them more manageable for detection algorithms and reducing computational complexity.
2Ease of manufacture
If traditional hash-based signatures are used, then implementation simplicity is improved, but resilience against perturbations deteriorates
Solution Approach 1:
The patent changes the parameter representation of hash signatures by applying multiple LSH functions with different parameters to the same input. Instead of using a single hash value, the system generates multiple projected representations with varying parameters, making the signature more resilient to perturbations while maintaining implementation feasibility through standard hashing operations.
Solution Approach 2:
The patent creates a composite signature structure by combining multiple LSH-projected hash representations. This composite approach integrates multiple transformed views of the original signature, creating a more robust representation that resists perturbations better than any single hash while building upon simple hashing fundamentals.
3Reliability
If machine learning solutions are applied to hash-based signatures, then detection capability is improved, but feature relevance deteriorates due to dimensionality
Solution Approach 1:
The patent extracts relevant features by selecting and emphasizing significant patterns from the multiple LSH-projected hash representations. The system identifies and extracts meaningful features that persist across different LSH projections, filtering out noise and irrelevant variations, thereby providing machine learning models with concentrated, relevant features while maintaining detection capability.
Data Source
AI summary
Methods, apparatus, systems, and articles of manufacture are disclosed to translate hash-based signature signals for machine learning applications. In one example, the apparatus includes a processor to execute instructions to determine an element count for a plurality of hash elements of a locality sensitivity hash, preserve ones of hash elements of the plurality of hash elements that satisfy an element count threshold, and produce a cluster of encoded feature vectors of the preserved ones of the hash elements. The processor further to execute instructions to determine an occurrence frequency of hash elements in the cluster and create a synthetic hash of the cluster based on a subset of the hash elements in the cluster that satisfy an occurrence frequency threshold.