Machine Learning Verdicts for Cyberattack Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cyberattack defense platforms are inadequate in detecting and processing information security events, often resulting in false positives that waste time and resources, and fail to effectively identify genuine incidents due to their limitations in handling complex and long-duration attacks.
Innovation Solution
A method involving a trained machine learning model to analyze information security events, determining verdicts on whether they are incidents or false positives by evaluating characteristics and sources of security notifications, and adjusting thresholds based on analysis results to reduce false positives and prioritize genuine incidents for further analysis.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional defense platforms use traditional detection methods (signature analysis, heuristic analysis), then they can detect known threats, but they fail to detect previously unknown threats and complex attacks
Solution Approach 1:
The system performs preliminary analysis of information security events using machine learning models to identify patterns and characteristics before full investigation. The model pre-evaluates events to determine likelihood of being false positives, preparing ranked lists for expert review and reducing the need for comprehensive analysis of all events
Solution Approach 2:
The patent replaces traditional mechanical detection methods (signature matching, heuristic rules) with a machine learning-based system that automatically analyzes event characteristics, sources, and patterns to determine verdicts, substituting manual expert judgment with an automated intelligent system
2Reliability
If the system analyzes all information security events to ensure comprehensive detection, then genuine incidents are identified, but the large number of false positives causes experts to waste time and overlook real incidents
Solution Approach 1:
The system segments information security events into different categories based on machine learning evaluation: high-confidence false positives, low-confidence false positives, and potential genuine incidents. This segmentation allows experts to focus their time on events that require detailed analysis while automatically handling obvious false positives
Solution Approach 2:
The machine learning model acts as an intermediary between automatic detection systems and human experts, filtering and ranking events before they reach experts. The model provides preliminary verdicts and confidence scores that guide expert attention to the most critical cases
3Productivity
If the system increases the number of InfoSec experts to reduce false positive analysis time, then more incidents can be reviewed, but expenses continuously increase
Solution Approach 1:
The system enables self-service by allowing the machine learning model to automatically analyze and verdict information security events without requiring human expert intervention for every case. The model independently handles false positive identification and event prioritization, reducing dependency on human resources
4Ease of operation
If conventional systems use fixed detection thresholds, then the system is simple to operate, but it cannot adapt to different attack patterns and generates many false positives
Solution Approach 1:
The system implements dynamic thresholds that automatically adjust based on machine learning model confidence scores and historical performance data. Detection thresholds are no longer fixed but adapt to changing attack patterns and system conditions, improving reliability while maintaining ease of operation through automated adjustment
Data Source
Figure 1a
Figure 1b
Figure 2
AI summary
A method for processing information security events of a computer system includes receiving information related to a plurality of information security events occurred in the computer system. Each of the events includes an event related to a possible violation of information security of the computer system. A verdict is determined for each of the events. The verdict includes: i) information security incident or ii) false positive. The verdict is false positive if the probability of a false positive for the corresponding event is greater than a first threshold. Verdicts are changed for a subset of the events from the false positive to the information security incident. A number of events in the subset is lower than a second threshold. An analysis of the events having a verdict of the information security incident is performed to determine if the computer system is under a cyberattack.