ML WAF Feature Grouping for Attack Probability Explanation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing web application firewalls (WAFs), particularly those based on machine learning (ML), face challenges in providing clear explanations for attack probabilities and require complex administration due to the large number of features involved.
Innovation Solution
The implementation of feature groups within an ML-based WAF, which categorizes attack probabilities generated by the WAF by grouping individual features into smaller, more manageable categories, allowing for easier understanding and administration.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning features are used to detect attacks, then attack detection accuracy is improved, but system complexity increases due to the large number of features
Solution Approach 1:
The patent segments the large number of machine learning features into feature groups organized in a hierarchical structure. The feature group engine divides features into parent groups and child groups, creating a tree-like hierarchy that breaks down complex feature sets into manageable segments. This segmentation reduces the cognitive load on administrators while preserving all individual features for accurate attack detection.
2Measurement precision
If individual features are used to determine attack probability, then detection precision is improved, but ease of operation deteriorates due to difficulty in understanding and administration
Solution Approach 1:
The patent adds a hierarchical dimension to the feature organization by creating parent-child group relationships. This dimensional transformation allows administrators to navigate and understand features through multiple levels of abstraction, from high-level parent groups to specific child features, making the system easier to operate without losing detection precision.
Solution Approach 2:
The feature groups act as intermediary layers between individual features and administrators. These intermediate groupings provide a structured view that mediates between the complexity of individual features and the need for simple administration, allowing users to manage groups rather than individual features while maintaining full visibility into underlying features.
3Reliability
If comprehensive feature analysis is performed, then attack detection reliability is improved, but administrative complexity increases
Solution Approach 1:
The hierarchical feature group structure segments comprehensive feature analysis into organized groups, maintaining all features for reliable detection while structuring them to reduce administrative complexity. Administrators can manage and understand features through the hierarchical organization without needing to directly handle every individual feature.
Solution Approach 2:
The feature groups serve multiple functions simultaneously: they organize features for easier administration, provide hierarchical navigation for understanding, maintain comprehensive feature coverage for reliable detection, and enable flexible configuration. This multi-functionality resolves the contradiction between reliability and administrative complexity.
Data Source
AI summary
According to some embodiments of the disclosure, a method includes receiving an electronic communication directed to a data resource, determining, by a machine learning (ML) web application firewall (WAF), an attack probability of the electronic communication based on a plurality of features, wherein subsets of the plurality of features are arranged in a plurality of feature groups, adjusting the attack probability based on respective feature weights of the plurality of feature groups.