MDR System Real-Time Cyber-Attack Detection via ML Tagging
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current systems fail to effectively detect and respond to cyber-attacks in real-time, often missing imminent threats and requiring days or months to identify malicious activities targeting online assets, which can compromise business operations and customer interactions.
Innovation Solution
A system and method utilizing machine learning classification models to analyze and tag online data from various sources, including the deep and dark web, to identify potential cyber-threats and subscriber-specific subjects of interest, enabling real-time alerts and automatic mitigation measures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If traditional monitoring systems are used to detect cyber-attacks, then system complexity is reduced, but detection speed and real-time response capability deteriorate (days or months delay)
Solution Approach 1:
The system segments the detection process into multiple specialized modules: data collection module, data processing module, machine learning model module, and alert generation module. Each module handles specific tasks independently, enabling parallel processing and faster detection without overwhelming system complexity.
Solution Approach 2:
The system performs preliminary actions by continuously collecting and pre-processing data from multiple sources (dark web, deep web, surface web) before attacks occur. Machine learning models are trained in advance on historical data to recognize attack patterns, enabling real-time detection without complex runtime analysis.
2Measurement precision
If comprehensive data collection from multiple sources is implemented, then detection accuracy improves, but data processing time and computational resources increase
Solution Approach 1:
The system implements periodic data collection from multiple sources at scheduled intervals, rather than continuous monitoring. This reduces data processing time while maintaining detection accuracy by capturing sufficient information at regular checkpoints.
Solution Approach 2:
The system uses machine learning models that create simplified representations (copies) of complex attack patterns from training data. These models quickly classify new data without requiring exhaustive analysis of all raw data, reducing processing time while maintaining accuracy.
3Measurement precision
If machine learning models are trained with extensive manual tagging, then model accuracy improves, but training time and human resources increase
Solution Approach 1:
The system uses a hybrid approach where only critical data points require manual tagging, while less critical data is tagged using automated rules or left untagged. This partial action approach achieves sufficient model accuracy without the excessive time investment of complete manual tagging.
Solution Approach 2:
The machine learning model performs self-training by automatically learning patterns from the data it processes. The system reduces human intervention by enabling the model to self-adjust and improve accuracy over time without requiring extensive continuous manual tagging.
Data Source
AI summary
A method for detecting an occurrence of an online event including retrieving a data item from online sources; forming a list by tagging words and/or strings within the data item according to predefined attributes such that the list includes the words and/or strings with their corresponding attributes; forming sequence items relating to the list according to a predefined criterion such that each sequence item includes at least the list and optionally additional preformed lists that have been formed in the same manner as the list and that have a shared concept with the list according to the predefined criterion; running each of the sequence items in a preformed machine learning classifying model that outputs a determination if there is an occurrence of the online event or not. The present invention further relates to generating the machine learning classifying model. The present invention also relates to a corresponding system.