ML Threat Mitigation for Blocking Anomalous Network Paths
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current network security systems rely on static firewall policies that fail to promptly adapt to new and emerging threats, allowing bad actors ample time to access and exfiltrate data due to the delay in updating firewall rules.
Innovation Solution
A machine learning-based system that proactively monitors network traffic, detects compromised devices and malicious requests, and implements security protocols to prevent data transmission to such devices, using a training dataset to adapt to new threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If static firewall policies are used to protect network security, then known security threats can be caught, but there is a significant delay in updating firewall rules to mitigate new threats
Solution Approach 1:
The patent transforms the static firewall policy into a dynamic system by implementing a machine learning model that continuously learns from network traffic patterns and automatically updates threat detection rules. The system dynamically adapts to new threats by training the model on incoming data, eliminating the manual update delay inherent in traditional static firewall policies.
Solution Approach 2:
The machine learning system performs self-updating by automatically training on new network traffic data and generating updated detection rules without requiring manual intervention. The system serves itself by continuously improving its threat detection capabilities through automated learning from observed network patterns, thereby eliminating the time loss associated with manual rule updates.
2Loss of time
If machine learning algorithms are used to proactively detect threats, then detection timeliness is improved, but system complexity increases
Solution Approach 1:
The patent introduces a machine learning model as an intermediary between raw network traffic and threat detection decisions. This intermediary layer processes and interprets complex network patterns, enabling timely threat detection while abstracting the complexity from the core firewall system. The model serves as a mediator that translates raw data into actionable security decisions.
Solution Approach 2:
The system segments the threat detection function into a separate machine learning module that can be independently trained and updated. This segmentation allows the complex ML operations to be isolated from the core firewall infrastructure, enabling timely threat detection through specialized processing while managing overall system complexity through modular architecture.
Data Source
AI summary
A system for improving network security using machine learning-based threat mitigation is disclosed. The system accesses a data packet that is intended to be communicated to a destination device. The system extracts a first set of network features from the data packet and determines a network path associated with the data packet based on the extracted first set of network features. The system determines, using a machine learning algorithm, based on a training dataset and the extracted first set of network features, that the first destination device is anomalous. In response, the system performs one or more countermeasure actions comprising preventing the data packet from traversing to the first destination device in the network.