Network Activity Scoring for Low-False-Positive Threat Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems for identifying malicious network activity are prone to false positives, rely heavily on human subjectivity, and struggle to accurately detect new or evolving malicious patterns due to insufficient training data and reliance on underfit machine learning models.
Innovation Solution
A data-driven model that utilizes a machine learning model to score network activity based on historic patterns and contextual information, capable of identifying both known and new malicious activities while reducing false positives, by employing a modular framework that includes signature-based and anomaly-based approaches.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning models are trained to identify malicious activity using supervised learning, then identification accuracy may improve, but the system requires sufficient labeled malicious activity data which is often unavailable
Solution Approach 1:
The system performs preliminary actions by generating synthetic malicious activity data through simulation before actual identification is needed. The digital twin technology pre-generates labeled training data by simulating various attack scenarios, eliminating the need to wait for sufficient real-world labeled data to accumulate.
Solution Approach 2:
The system creates copies of real network environments and behaviors through digital twins. By copying actual network traffic patterns and creating virtual representations of malicious activities, the system generates sufficient training data without requiring extensive real-world malicious activity samples.
2Productivity
If conventional systems identify malicious activity by determining acceptable deviation from normal activity, then some malicious activity can be detected, but false positives increase and human subjectivity reduces reliability
Solution Approach 1:
The system implements continuous feedback loops where identification results are fed back into the digital twin for validation and model refinement. This closed-loop approach automatically adjusts detection thresholds and parameters based on performance metrics, eliminating human subjectivity while maintaining high detection accuracy and reliability.
Solution Approach 2:
The system replaces the mechanical human monitoring process with automated machine learning models and digital twin simulations. This substitution eliminates human subjectivity and fatigue, providing consistent, reliable, and scalable malicious activity detection without depending on individual analyst judgment.
3Loss of time
If machine learning models are trained with limited data, then training can be completed quickly, but the models become underfit and achieve limited accuracy
Solution Approach 1:
The system performs preliminary data generation through digital twin simulations before model training begins. By pre-generating extensive synthetic training data that mimics real-world scenarios, the system ensures models are trained on sufficient diverse data without extending the actual training timeline, achieving both speed and accuracy.
Solution Approach 2:
The system dynamically adjusts training parameters and data sampling strategies based on the digital twin's understanding of the environment. By optimizing learning rates, batch sizes, and data augmentation parameters, the system achieves high model accuracy efficiently without requiring excessive training time or data.
Data Source
AI summary
Disclosed herein are methods and systems for identifying malicious network activity. In an embodiment, a method comprises monitoring, by a computer, network activity of a user having a baseline network activity; executing, by the computer, a machine learning model to determine a network activity score indicating a likelihood of the network activity being malicious activity for the baseline network activity, the machine learning model having been previously trained based on malicious activity and corresponding baseline network activity; and displaying, by the computer, the network activity score.