ML Pipeline Traffic Classification Verification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Signature-based malware detection systems struggle to identify new or unknown threats due to their reliance on pre-defined signatures, making it difficult to keep up with the increasing complexity and size of the threat landscape, and they often produce inaccuracies in traffic classification and malware detection, leading to false positives.
Innovation Solution
Implementing a Machine Learning (ML) pipeline that utilizes a distributed network and blockchain technology to verify traffic classification by cross-referencing with semi-trusted third-party providers, allowing for decentralized updates and consensus-based validation of classifications to enhance accuracy and reduce false positives.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If signature-based detection is used, then known threats can be identified accurately, but new or unknown threats cannot be detected
Solution Approach 1:
The patent replaces the mechanical signature-matching system with a machine learning-based detection system. The ML model learns patterns and characteristics of malware from training data, enabling it to detect both known and unknown threats without relying on pre-defined signatures. This substitution allows the system to adapt to new threats automatically through continuous learning.
Solution Approach 2:
The patent changes the detection parameters from fixed signature patterns to dynamic ML model parameters that can be updated and refined. By using ML algorithms with adjustable parameters (weights, biases, thresholds), the system can adapt its detection criteria based on learned patterns, improving both accuracy and adaptability to new threats.
2Measurement precision
If ML pipeline is used for traffic classification, then detection accuracy improves, but false positives increase
Solution Approach 1:
The patent implements a feedback mechanism where the ML pipeline's classification results are verified by a distributed network of nodes. Each node independently classifies the same traffic and compares results. Discrepancies trigger re-evaluation and feedback loops that allow the system to learn from errors and adjust classification thresholds, thereby reducing false positives while maintaining high accuracy.
Solution Approach 2:
The patent introduces an intermediary verification layer between the initial ML classification and the final decision. A distributed consensus mechanism acts as an intermediary that validates ML pipeline outputs by cross-checking with multiple independent classifications. This intermediary layer filters out false positives by requiring consensus among multiple nodes before confirming a classification.
3Measurement precision
If distributed network with multiple nodes is used, then classification accuracy is verified, but system complexity increases
Solution Approach 1:
The patent segments the verification function across multiple independent nodes in a distributed network. Each node performs a simplified classification task independently, and the overall verification accuracy emerges from the aggregation of these segmented operations. This segmentation distributes the computational load and complexity across multiple simple units rather than requiring one complex centralized system.
Solution Approach 2:
The patent creates a universal verification protocol that can be implemented by any node in the distributed network. Each node runs the same classification and verification algorithms, making the system multi-functional and adaptable. This universality reduces complexity by using identical, well-defined components throughout the network rather than requiring specialized logic at each node.
4Reliability
If blockchain technology is used for consensus validation, then classification reliability improves, but processing time increases
Solution Approach 1:
The patent performs preliminary classification actions at each node before the consensus validation process. Nodes independently classify traffic in advance, preparing results for subsequent verification. This preliminary action reduces the time required for consensus validation because the heavy lifting of classification is already done, and the blockchain process only needs to verify and aggregate pre-computed results.
Solution Approach 2:
The patent implements a partial consensus mechanism where not all nodes need to fully validate every classification. Instead, a threshold number of nodes or a subset of nodes performs verification, providing sufficient reliability without requiring complete consensus from the entire network. This partial action approach maintains reliability while significantly reducing processing time compared to full consensus requirements.
Data Source
AI summary
Systems, methods, computer-readable media, and devices are disclosed for verifying traffic classification. At a first node, a classification to a received packet is designated according to a local model. The classification of the packet by the first node is verified by sending packet information describing the packet to a distributed network comprising multiple nodes, where the packet information includes attributes of the packet. The classification of the packet is verified from receiving results from a second node that, based on the attributes, independently classifies the packet. Based on the verified classification, decentralized information for classifying packets is updated.