Machine Learning Score Obfuscation via Multi-Classifier Selection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models' outputs can be intercepted and manipulated by malicious actors, leading to inaccurate classifications, particularly in applications like malware detection, where iterative modifications can result in a desired classification being achieved, compromising security.
Innovation Solution
Implementing multiple classification models with different scoring paradigms, where features are extracted from an artefact, reduced, and input into a selected model to generate a score, making it difficult for malicious actors to reverse-engineer or manipulate the classification process, using mechanisms like random selection or load balancing to choose the model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If a single classification model is used, then the system is simple and easy to operate, but the output can be intercepted and manipulated by malicious actors to achieve desired classifications
Solution Approach 1:
The patent divides a single classification model into multiple classification models (first, second, and third models) with different scoring paradigms. Each model processes the input data independently and generates its own score, preventing malicious actors from manipulating a single model's output. The segmentation of the classification function into multiple independent models directly addresses the vulnerability of single-model systems while maintaining operational simplicity through automated score aggregation.
Solution Approach 2:
The patent combines the outputs of multiple classification models by aggregating their scores to produce a final classification result. The scores from different models (which use different scoring paradigms) are merged through a scoring aggregation mechanism, creating a more robust classification system that leverages the strengths of multiple models while mitigating individual model vulnerabilities.
2Object-affected harmful factors
If multiple classification models with different scoring paradigms are used, then the output is obfuscated and resistant to manipulation, but the system complexity increases
Solution Approach 1:
The patent employs multiple classification models that differ in their scoring paradigms (parameters). Each model uses a different scoring function and evaluation criteria, making it difficult for malicious actors to predict or manipulate the final classification outcome. By changing the scoring parameters across multiple models, the system achieves resistance to manipulation while the automated aggregation process manages the complexity of coordinating multiple models.
Solution Approach 2:
The patent introduces a score aggregation mechanism that acts as an intermediary between multiple classification models and the final classification decision. This intermediary component receives scores from different models with different paradigms, processes them according to defined aggregation rules, and produces the final classification. The intermediary simplifies the complexity by providing a standardized interface that handles the integration of multiple diverse model outputs.
3Productivity
If feature reduction techniques are applied, then the processing efficiency is improved, but the information loss may affect classification accuracy
Solution Approach 1:
The patent applies feature reduction techniques that retain only the most relevant features for classification, using partial action to focus computational resources on critical data dimensions. By selecting and processing only the most important features rather than all available features, the system improves processing efficiency while maintaining sufficient classification accuracy through the use of multiple models that can compensate for individual feature limitations.
Data Source
AI summary
An artefact is received. Thereafter, features are extracted from the artefact and a vector is populated. Later, one of a plurality of available classification models is selected. The classification models use different scoring paradigms while providing the same or substantially similar classifications. The vector is input into the selected classification model to generate a score. The score is later provided to a consuming application or process. The classification model can characterize the artefact as being malicious or benign to access, execute, or continue to execute so that appropriate remedial action can be taken or initiated by the consuming application or process. Related apparatus, systems, techniques and articles are also described.