Network Security Classification Using Human Control Signals
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Enterprise networks face challenges in detecting and mitigating malicious network traffic, particularly DoS attacks and data exfiltration, as existing anomaly detection methods struggle with distinguishing between normal and malicious behavior, especially with the increasing use of encryption by malware.
Innovation Solution
A network security service classifies devices as human-controlled or self-controlled and online resources accordingly, using machine learning classifiers to determine if access attempts constitute security violations, initiating mitigation actions based on these classifications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If machine learning classifiers are used to classify devices and online resources as human-controlled or self-controlled, then security violation detection accuracy is improved, but device complexity and processing time increase
Solution Approach 1:
The system segments the security analysis task into two independent classification processes: (1) classifying devices as human-controlled or self-controlled, and (2) classifying online resources as human-accessible or machine-accessible. This segmentation allows each classifier to focus on specific features, improving accuracy while keeping individual classifier complexity manageable.
Solution Approach 2:
The patent introduces an intermediary classification layer that translates raw device and resource characteristics into standardized control type labels (human-controlled/self-controlled). This intermediary layer simplifies the subsequent security violation detection by providing pre-classified inputs, reducing the overall system complexity.
2Speed
If machine learning classifiers analyze traffic data in real-time, then security violation detection speed is improved, but computational energy consumption increases
Solution Approach 1:
The system performs preliminary classification of devices and online resources before security violation detection. By pre-classifying devices as human-controlled or self-controlled and resources as human-accessible or machine-accessible, the system avoids performing full security analysis on every traffic packet, significantly reducing real-time computational energy consumption while maintaining fast detection speed.
Solution Approach 2:
The patent applies partial action by focusing classification efforts only on critical traffic patterns that may indicate security violations. Rather than analyzing all traffic data in full detail, the system applies classification selectively to suspicious or high-risk traffic, reducing overall energy consumption while maintaining detection effectiveness.
3Reliability
If the service monitors and classifies all device-access attempts to online resources, then security coverage is improved, but network traffic overhead increases
Solution Approach 1:
The system applies local quality by differentiating security monitoring intensity based on device and resource classifications. Human-controlled devices accessing human-accessible resources receive standard monitoring, while self-controlled devices attempting to access such resources trigger enhanced security analysis. This localized approach ensures comprehensive security coverage while minimizing unnecessary monitoring overhead on legitimate traffic.
Solution Approach 2:
The patent changes the monitoring parameter dynamically based on classification results. When a self-controlled device attempts to access a human-accessible resource, the system increases monitoring intensity and applies stricter security rules. For legitimate human-controlled access patterns, monitoring is reduced to baseline levels, optimizing network bandwidth usage while maintaining security coverage.
Data Source
AI summary
In one embodiment, a service classifies a device in a network as human-controlled or self-controlled. The service also classifies an online resource as designed for access by human-controlled devices or by self-controlled devices. The service obtains traffic data regarding an attempt by the device to access the online resource via the network. The service determines that the attempt by the device to access the online resource is a security violation, based on the classifications of the device and the online resource. The service initiates a mitigation action in the network for the security violation.