Application Priority-Based Malicious Message Interception
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for generating training datasets for malware detection classifiers are inefficient due to the lack of timely access to diverse malicious messages, leading to imbalanced datasets and resource-intensive processes, which can result in false positives and inadequate detection of malicious messages across various applications.
Innovation Solution
A system that selects applications based on priority levels, monitors network activity, and extracts electronic messages to create a balanced dataset for training classifiers, using a formula that considers the number of devices affected and the time since the application's last update, with a focus on applications capable of network data exchanges.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If manual generation of training datasets is used, then dataset quality can be controlled, but the process is time-consuming and resource-intensive
Solution Approach 1:
The system enables automatic self-generation of training datasets by having the malware detection system itself collect, filter, and store malicious messages from network activity logs. The application selection module automatically selects applications based on priority levels, and the network interception module captures messages without requiring manual intervention from IT experts, thus transforming a manual process into an autonomous one.
Solution Approach 2:
The system performs preliminary actions by proactively selecting high-priority applications and intercepting their messages before they are fully analyzed manually. The application selection module pre-determines which applications to focus on based on priority criteria (recent updates, high device impact), and the network interception module preemptively captures messages from these selected applications, eliminating the need for manual search and analysis later.
2Measurement precision
If training datasets comprise mostly malicious messages from frequently updated applications, then detection accuracy for those applications improves, but detection capability for less updated applications deteriorates
Solution Approach 1:
The system applies local quality by assigning different priority levels to different applications based on their specific characteristics (update frequency, device impact). The application selection module evaluates each application individually and selects those with higher priority (recent updates, high device presence), ensuring that the training dataset reflects the actual security priorities and resource allocation of the organization rather than treating all applications uniformly.
Solution Approach 2:
The system changes the parameter of application selection criteria from uniform treatment to priority-based differentiation. The application selection module calculates priority levels based on multiple parameters (time since last update, number of affected devices) and uses these dynamic parameters to determine which applications receive messages for training, thereby adapting the dataset composition to current security needs and application states.
3Adaptability or versatility
If all applications are monitored for malicious messages, then comprehensive coverage is achieved, but computing resources are excessively consumed
Solution Approach 1:
The system segments the monitoring process by dividing all applications into priority groups. The application selection module filters applications based on priority criteria (recent updates, high device impact) and selects only those high-priority applications for intensive monitoring. This segmentation allows the system to focus computing resources on the most critical applications while maintaining comprehensive coverage of security threats in those areas.
Solution Approach 2:
The system applies partial action by monitoring and intercepting messages only from high-priority applications rather than all applications. The application selection module determines which applications warrant full monitoring based on their priority levels, and the network interception module selectively captures messages only from these selected applications, reducing overall computing resource consumption while maintaining adequate security coverage.
4Productivity
If classification systems are trained with imbalanced datasets, then they can detect common threats, but they produce false positives and miss emerging threats
Solution Approach 1:
The system implements feedback mechanisms where the application selection module continuously monitors network activity and updates the training dataset based on actual malware detection results. The network interception module captures messages from high-priority applications, and this feedback loop ensures that the training dataset remains balanced and up-to-date, preventing false positives and improving detection accuracy for emerging threats.
Data Source
AI summary
Disclosed herein are systems and method for intercepting malicious messages for training a malware detection classifier. In an exemplary aspect, an application selection module may select, from a plurality of applications, an application for execution in an execution environment based on a priority level of the application. During the execution of the selected application, a network interception module may monitor network activity comprising information about data being sent and received over a network connected to the execution environment and storing the network activity in memory of the execution environment (e.g., in a network activity log). A message selection module may subsequently extract, from the stored network activity, an electronic message, in response to determining that the electronic message corresponds to the selected application, may storing the electronic message in a message database used for training the malware detection classifier.