Network Security Tool Using Word Probability Distributions
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing network security tools are often inaccurate, leading to false negatives and false positives, and are unable to automatically set access privileges, compromising network security when malicious users communicate over the network or when well-intended users perform unauthorized actions.
Innovation Solution
A network security tool that scans messages to identify the probability distribution of words and their co-occurrence, analyzing these distributions to determine if messages are related to malicious or authorized activities, allowing for automatic identification of malicious messages and appropriate access privileges without requiring a taxonomy or concept map.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Extent of automation
If existing security tools use trigger word scanning to identify malicious messages, then automated message filtering is achieved, but accuracy deteriorates resulting in false positives and false negatives
Solution Approach 1:
The patent transforms the security tool from using simple trigger word presence/absence to analyzing probability distributions of word co-occurrence. This parameter change from binary detection to probabilistic analysis enables more nuanced message classification, reducing false positives while maintaining automation.
Solution Approach 2:
The invention adds a new dimension to message analysis by examining co-occurrence patterns across multiple words rather than isolated trigger words. This multi-dimensional approach captures contextual relationships, improving classification accuracy while preserving automated operation.
2Measurement precision
If administrators manually review each user to set access privileges, then access control precision is improved, but productivity deteriorates due to time-consuming manual processes
Solution Approach 1:
The system enables automatic assignment of access privileges by analyzing the semantic similarity between user descriptions and job description profiles. This self-service approach eliminates manual administrator intervention while maintaining accurate privilege assignment based on probabilistic matching.
Solution Approach 2:
The patent replaces the mechanical manual review process with an automated semantic analysis system using probability distributions and cosine similarity calculations. This substitution maintains precision while dramatically improving productivity by eliminating manual labor.
3Ease of operation
If existing tools classify messages based on simple keyword matching, then ease of operation is improved, but reliability deteriorates due to false negatives compromising network security
Solution Approach 1:
The system performs preliminary analysis by building comprehensive probability distribution profiles from training data before actual message classification. This preparatory step creates a robust reference framework that enhances reliability while maintaining operational simplicity during actual security monitoring.
Solution Approach 2:
The invention introduces probability distributions as an intermediary layer between simple keyword matching and complex semantic understanding. This intermediary enables reliable security detection by capturing nuanced patterns without requiring complex algorithms, preserving ease of operation.
Data Source
AI summary
An apparatus includes a memory and a hardware processor. The memory stores a threshold. The processor receives first, second, and third messages. The processor determines a number of occurrences of words in the messages. The processor also calculates probabilities that a word in the messages is a particular word and co-occurrence probabilities. The processor further calculates probability distributions of words in the messages. The processor also calculates probabilities based on the probability distributions. The processor compares these probabilities to a threshold to determine whether the first message is related to the second message and/or whether the first message is related to the third message.