Neural Network Threat Clustering for Attachment-Based Campaign Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing cybersecurity systems struggle to effectively analyze large numbers of cybersecurity threats and group them into campaigns, leading to undetected threat campaigns and vulnerability to cyber-attacks due to the constantly changing threat landscape.

Innovation Solution

A computing platform uses neural networks trained with metric learning and sub-word embeddings to generate threat intelligence by clustering message attachments based on feature representations, identifying indicators of compromise, and sending user interface information to enterprise devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If traditional cybersecurity analysis methods are used to analyze large numbers of threats, then the analysis process becomes increasingly complex and time-consuming, but the ability to detect and group threat campaigns remains insufficient

Engineering Contradiction:

Improvethreat analysis speedVSAvoidanalysis system complexity

Core Design Contradiction:

ProductivityVSDevice complexity

Solution Approach 1:

The patent replaces traditional mechanical cybersecurity analysis methods with neural network-based automated analysis. The neural networks process threat data, generate feature representations, and perform clustering operations automatically, eliminating the need for manual analysis while significantly improving processing speed and reducing system complexity.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The system performs self-service through automated neural network processing. The neural networks autonomously analyze threat attachments, generate feature representations, perform clustering, and identify threat campaigns without human intervention. This self-service capability enables the system to handle large volumes of threats efficiently while maintaining low operational complexity.

Inventive Principle:

Principle #25Self-service

2Measurement precision

If manual threat analysis is performed to identify threat campaigns, then detection accuracy may be improved, but the ability to keep pace with the constantly changing threat landscape deteriorates

Engineering Contradiction:

Improvethreat detection accuracyVSAvoidtime to detect threat campaigns

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

The system performs preliminary action by pre-training neural networks on extensive threat data before deployment. The neural networks are pre-trained to recognize patterns, generate appropriate feature representations, and perform clustering operations. This preliminary training enables the system to rapidly detect and respond to new threat campaigns as they emerge, maintaining both accuracy and speed.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent replaces manual threat analysis with automated neural network processing. The neural networks continuously analyze threats, generate feature representations, and identify campaigns in real-time, enabling the system to keep pace with the constantly evolving threat landscape while maintaining high detection accuracy through pattern recognition.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Productivity

If traditional clustering methods are used to group threats into campaigns, then the clustering process becomes computationally intensive, but the ability to provide actionable insights deteriorates

Engineering Contradiction:

Improvethreat clustering speedVSAvoidactionable intelligence quality

Core Design Contradiction:

ProductivityVSLoss of information

Solution Approach 1:

The system applies the extraction principle by using neural networks to generate compact feature representations that capture the essential characteristics of threats. These feature representations extract the most relevant information from raw threat data, enabling efficient clustering while preserving actionable intelligence. The neural networks identify and extract key features that distinguish different threat campaigns.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies parameter changes by transforming raw threat data into neural network-generated feature representations. This transformation changes the parameter space from raw attachments to structured feature vectors, enabling computationally efficient clustering operations. The feature representations maintain the essential information needed for identifying threat campaigns while reducing computational complexity.

Inventive Principle:

Principle #35Parameter changes

Data Source

PatentUS12388868B2Using neural networks to process forensics and generate threat intelligence information

Publication Date: 2025.08.12 GOLDMAN SACHS BANK USA

AI summary

Aspects of the disclosure relate to generating threat intelligence information. A computing platform may receive forensics information corresponding to message attachments. For each message attachment, the computing platform may generate a feature representation. The computing platform may input the feature representations into a neural network, which may result in a numeric representation for each message attachments. The computing platform may apply a clustering algorithm to cluster each message attachments based on the numeric representations, which may result in clustering information. The computing platform may extract, from the clustering information, one or more indicators of compromise indicating that one or more attachments corresponds to a threat campaign. The computing platform may send, to an enterprise user device, user interface information comprising the one or more indicators of compromise, which may cause the enterprise user device to display a user interface identifying the one or more indicators of compromise.