Machine-Learned Detection Pre-Screening for True Positive Triage
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The increasing volume of cyber security detections requires significant time and skill from human experts to differentiate between true positive and false positive reports, leading to inefficiencies in managing cyber security threats.
Innovation Solution
A cloud-based cyber security detection prediction service uses a machine learning model trained on human expert assessments to quickly and accurately classify cyber security detections as true or false positives, leveraging a cyber security assessment profile generated from millions of historical analyses.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If human expert analysts manually inspect and assess cyber security detections, then the accuracy of differentiation between true positive and false positive reports is improved, but the time consumption and productivity deteriorate due to the increasing volume of detections
Solution Approach 1:
A machine learning model is introduced as an intermediary between the detection system and human analysts. The model is trained on historical detection data with expert annotations to automatically classify new detections, handling the majority of cases without human intervention. This intermediary system maintains high accuracy while dramatically increasing throughput by filtering out false positives and prioritizing true positives for expert review.
Solution Approach 2:
The machine learning model performs preliminary assessment and classification of cyber security detections before they reach human experts. By pre-screening detections and preparing annotated data in advance, the system reduces the workload on human analysts and enables faster processing of the overall detection volume while maintaining assessment quality.
2Quantity of substance
If the volume of cyber security detections increases, then the coverage of monitored threats is improved, but the time and skill required for manual assessment increases proportionally
Solution Approach 1:
The machine learning model enables the detection system to serve itself by automatically processing and classifying detections without requiring proportional increases in human expert time. The system uses historical expert assessments to train the model, which then independently handles new detections, freeing experts from routine assessment tasks while maintaining comprehensive coverage of increasing threat volumes.
3Reliability
If human expert analysts are used to assess detections, then the reliability of security assessment is improved, but the device complexity and operational cost increase
Solution Approach 1:
The machine learning model creates a digital copy of human expert assessment capabilities by training on historical expert-annotated data. This copy captures the decision-making patterns and knowledge of multiple experts, enabling automated assessment that replicates expert-level reliability without requiring proportional increases in human resources or system complexity.
Data Source
AI summary
A cloud-based cyber security detection prediction service pre-screens cyber security detections reported by endpoint client devices. The endpoint client devices report the cyber security detections to a cloud-computing environment providing the cloud-based cyber security detection prediction service. The cyber security detections are compared to a cyber security assessment profile generated by a machine learning model trained using human expert cyber security assessments. The human expert cyber security assessments were applied by human cyber security subject matter experts scrutinizing historical detection data. The cloud-based cyber security detection prediction service thus provides a much faster cyber security prediction based on human expertise.