ML Clustering for Anomalous Vulnerability Data Filtering
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing computer network security systems face challenges in identifying and filtering out anomalous vulnerability data from the large volumes of data acquired for configuring vulnerability detection in cloud computing environments, leading to potential false vulnerability detection and resource wastage in updating software applications.
Innovation Solution
A machine learning-based method that uses clustering algorithms, such as DBSCAN, to identify outlier datapoints representing anomalous vulnerability data among vulnerability parameter values, allowing for the filtering out of such data and preventing its use in configuring vulnerability detection until further investigation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If vulnerability data is acquired and processed to configure detection, then vulnerability detection capability is improved, but anomalous data may be incorrectly included leading to false detection
Solution Approach 1:
The patent applies preliminary action by performing clustering and outlier detection on vulnerability data before it is used to configure detection rules. The system pre-processes the data to identify and filter out anomalous entries, ensuring that only clean, reliable data is used for configuring vulnerability detection. This prevents false detection by eliminating problematic data upstream in the processing pipeline.
Solution Approach 2:
The patent introduces an intermediary layer between raw vulnerability data acquisition and detection configuration. This intermediary consists of clustering algorithms and outlier detection mechanisms that act as a filter, separating reliable vulnerability data from anomalous data. The intermediary processes data through clustering to identify patterns and detects outliers to remove anomalies, thereby protecting the detection system from false positives.
2Reliability
If large volumes of vulnerability data are processed, then detection coverage is improved, but resource consumption and processing time increase
Solution Approach 1:
The patent applies segmentation by dividing the large volume of vulnerability data into clusters based on similarity characteristics. Instead of processing all data uniformly, the system segments data into meaningful groups using clustering algorithms, which allows for more efficient processing. Outlier detection then operates on these segmented clusters rather than the entire dataset, significantly reducing processing time while maintaining comprehensive coverage.
Solution Approach 2:
The patent extracts and removes anomalous data points from the vulnerability dataset using outlier detection techniques. By taking out and removing a small portion of anomalous data (typically a minority of the total dataset), the system reduces the effective processing volume while maintaining the integrity and coverage of the remaining legitimate vulnerability data, thereby improving processing efficiency.
3Measurement precision
If vulnerability data is used to configure detection rules, then detection accuracy is improved, but system complexity increases due to data filtering requirements
Solution Approach 1:
The patent implements self-service by enabling the system to automatically perform clustering and outlier detection on vulnerability data without requiring manual intervention or complex configuration. The system self-adjusts to identify patterns and filter anomalies autonomously, reducing the operational complexity of managing vulnerability data while maintaining high detection precision. The automated processes eliminate the need for manual data cleaning and verification steps.
Data Source
AI summary
Some embodiments provide a vulnerability data processing system that uses machine learning (ML) to identify anomalous vulnerability data among vulnerability data acquired for configuring vulnerability detection of a computer network security system configured to monitor a computing environment. The system obtains vulnerability data that comprises values of a vulnerability parameter. The system generates datapoints representing values of the vulnerability parameter included in the obtained vulnerability data. The system clusters the datapoints to obtain vulnerability parameter clusters. The system identifies anomalous vulnerability data using the vulnerability parameter clusters.