Malware Infection Risk Scoring via Bipartite Graph Semi-Supervised Learning
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Advanced malware infections, including zero-day attacks, IP fast flux, algorithmically generated domain names, and polymorphic malware, are difficult to identify with existing signature-based solutions and supervised learning techniques due to the lack of comprehensive ground truth data for training predictive models.
Innovation Solution
The implementation of semi-supervised learning methods on a bipartite graph to determine malware infection risk scores from partial known facts, allowing for the identification of potentially infected computers and websites without prior information, using network traffic data between inside and outside entities, and enabling rapid risk scoring in large-scale enterprise networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If signature-based solutions are used to identify malware, then known malware can be detected, but advanced malware including zero-day attacks cannot be identified
Solution Approach 1:
The system performs preliminary actions by collecting and analyzing network traffic data before malware infections occur. It builds a baseline of normal network behavior and relationships, enabling detection of deviations that indicate advanced malware attacks without requiring prior knowledge of specific malware signatures.
Solution Approach 2:
The patent transitions from traditional signature-based one-dimensional detection to multi-dimensional analysis by constructing a bipartite graph that captures relationships between internal and external entities across multiple dimensions (network traffic patterns, entity relationships, temporal behavior), enabling detection of sophisticated malware that lacks known signatures.
2Measurement precision
If supervised learning techniques are used, then predictive models can be trained, but comprehensive ground truth data is required which is often unavailable
Solution Approach 1:
The system applies partial action by utilizing only the available partial ground truth data rather than requiring complete labeled datasets. It performs semi-supervised learning where a subset of entities are labeled while others remain unlabeled, allowing the model to learn from partial information and propagate labels through the bipartite graph structure.
Solution Approach 2:
The bipartite graph structure serves as an intermediary that connects labeled and unlabeled entities. Through the graph's edge relationships, information flows from labeled entities to unlabeled ones, enabling indirect learning and label propagation without requiring direct ground truth for all entities.
3Reliability
If traditional malware scanning is performed, then infected files can be identified, but the process is time-consuming and cannot scale to large enterprise networks
Solution Approach 1:
The patent replaces the mechanical, sequential file-by-file scanning approach with a data-driven, parallel computing system. It substitutes traditional antivirus mechanics with machine learning models that process network traffic data in parallel across distributed computing infrastructure, dramatically increasing throughput and scalability.
Solution Approach 2:
The system segments the enterprise network into discrete entities (internal systems, external entities, network traffic flows) and represents them as nodes and edges in a bipartite graph. This segmentation enables parallel processing of individual entities and relationships, allowing simultaneous risk assessment across hundreds of thousands of endpoints without sequential bottlenecks.
Data Source
AI summary
Methods, systems, and apparatus, including computer programs encoded on computer storage media, for performing semi-supervised learning on partially labeled nodes on a bipartite graph. One described method can determine a useful score of malware infection risk from partial known facts for entities modeled as nodes on a bipartite graph, where network traffic is measured between inside-the-enterprise entities and outside-the-enterprise entities. This and other methods can be implemented in a large-scale massively parallel processing database. Methods of scaling the partial label input and of presenting the results are also described.