Machine Learning Model for Cyberattack Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Conventional cyberattack defense platforms are ineffective in detecting and distinguishing between genuine information security incidents and false positives, leading to wasted resources and increased risk of overlooking actual threats due to their limitations in handling complex and long-duration attacks.

Innovation Solution

A method involving a trained machine learning model to process information security events, where events are classified as either incidents or false positives based on probability thresholds, with the model analyzing characteristics and sources of events to determine verdicts and adjust thresholds dynamically for improved accuracy.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If conventional defense platforms use signature analysis and heuristic analysis to detect threats, then known malware can be detected, but previously unknown threats and complex attacks cannot be detected

Engineering Contradiction:

Improvedetection accuracyVSAvoidcapability to detect unknown threats

Core Design Contradiction:

ReliabilityVSAdaptability or versatility

Solution Approach 1:

The system performs preliminary classification of security events using a trained machine learning model before expert analysis. Events are pre-sorted into false positives and potential incidents based on probability thresholds, so that experts only need to analyze events that are likely to be real threats, rather than investigating all events equally

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual expert judgment with an automated machine learning-based classification system. The ML model automatically evaluates security events and assigns probability scores, substituting the mechanical process of expert analysis with an automated computational system that can handle large volumes of events consistently

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Productivity

If SIEM systems correlate InfoSec events with known threat data to detect incidents, then automated detection is improved, but the number of false positives increases

Engineering Contradiction:

Improveautomated detection capabilityVSAvoidfalse positive rate

Core Design Contradiction:

ProductivityVSMeasurement precision

Solution Approach 1:

The system implements feedback loops where expert analysis results are fed back into the machine learning model for continuous improvement. Experts verify or correct the ML model's classifications, and this feedback is used to retrain and refine the model, gradually improving its precision while maintaining high automated detection rates

Inventive Principle:

Principle #23Feedback

Solution Approach 2:

The classification thresholds and model parameters are made dynamic rather than static. The system can adjust probability thresholds based on operational context, and the ML model is continuously retrained with new data, allowing the system to adapt to changing threat landscapes and operational requirements

Inventive Principle:

Principle #15Dynamics

3Reliability

If a large number of InfoSec experts are employed to analyze incidents, then genuine incidents can be identified, but operational costs and time consumption increase

Engineering Contradiction:

Improveincident identification accuracyVSAvoidtime spent analyzing false incidents

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The system extracts and removes false positives from the set of events requiring expert analysis. By using the ML model to identify and filter out events with high probability of being false positives, the system extracts only the relevant events that need human expertise, significantly reducing the time experts spend on unproductive analysis

Inventive Principle:

Principle #2Taking out (Extraction)

4Reliability

If conventional systems analyze all InfoSec events thoroughly, then detection completeness is improved, but resource waste on false positives increases

Engineering Contradiction:

Improvedetection completenessVSAvoidcomputational resources on false positives

Core Design Contradiction:

ReliabilityVSLoss of energy

Solution Approach 1:

The system applies partial analysis to all events through automated ML classification, and reserves excessive (thorough) analysis only for events that pass the initial filtering. This two-stage approach ensures that complete analysis is applied only when necessary, maintaining detection completeness for real threats while avoiding wasteful exhaustive analysis of false positives

Inventive Principle:

Principle #16Partial or excessive action

Data Source

PatentUS11611572B2System and method of processing information security events to detect cyberattacks

Publication Date: 2023.03.21 AO KASPERSKY LAB

AI summary

A method for processing information security events of a computer system includes receiving information related to a plurality of information security events occurred in the computer system. Each of the events includes an event related to a possible violation of information security of the computer system. A verdict is determined for each of the events. The verdict includes: i) information security incident or ii) false positive. The verdict is false positive if the probability of a false positive for the corresponding event is greater than a first threshold. Verdicts are changed for a subset of the events from the false positive to the information security incident. A number of events in the subset is lower than a second threshold. An analysis of the events having a verdict of the information security incident is performed to determine if the computer system is under a cyberattack.