Projected Vector Overflow Penalties for Machine Learning String Stuffing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Adversarial techniques such as score fuzzing and string stuffing can manipulate machine learning models to misclassify artifacts, particularly malware, by adding strings to modify the classification output.
Innovation Solution
A method involving feature reduction operations, including principal component analysis and random projection matrices, to generate an overflow vector, which is used to identify and penalize features exceeding a threshold, thereby adjusting the classification score to prevent misclassification.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If machine learning models are deployed to classify artifacts, then classification capability is improved, but vulnerability to adversarial manipulation increases
Solution Approach 1:
The patent introduces an intermediary penalty mechanism that sits between the raw classification score and the final output. This intermediary layer calculates a penalty based on the distribution of feature values and subtracts it from the original score, thereby mediating the effect of adversarial manipulations while preserving the model's classification capability.
Solution Approach 2:
The patent applies preliminary anti-action by computing a penalty term before final score determination. The penalty is calculated based on the overflow of feature values beyond expected ranges, and this penalty is subtracted from the classification score in advance of the final decision, preventing manipulative strings from unduly influencing the outcome.
2Reliability
If feature reduction operations are applied to mitigate string stuffing, then resistance to manipulation is improved, but computational complexity increases
Solution Approach 1:
The patent changes parameters by transforming the feature space through reduction operations such as random projection or principal component analysis. This parameter transformation reduces the dimensionality of the input features while preserving the essential information needed for classification, thereby reducing the impact of string stuffing without requiring complete retraining of the model.
Solution Approach 2:
The patent applies preliminary action by performing feature reduction operations before the classification process. This pre-processing step reduces the dimensionality of the feature space and removes redundant or manipulative features before they can significantly influence the classification outcome, thereby reducing computational complexity during the main classification phase.
3Ease of operation
If existing machine learning models are used without retraining, then ease of operation is improved, but vulnerability to score fuzzing increases
Solution Approach 1:
The patent extracts the vulnerability to score fuzzing by identifying and isolating the problematic feature contributions. By calculating a penalty based on the overflow of feature values beyond expected ranges, the system extracts and neutralizes the harmful effect of manipulative strings without needing to retrain the entire model, thereby maintaining ease of operation while reducing vulnerability.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An artifact is received from which features are extracted and used to populate a vector. The features in the vector are then reduced using a feature reduction operation to result in a modified vector having a plurality of buckets. Features within the buckets of the modified vector above a pre-determined projected bucket clipping threshold are then identified. Using the identified features, and overflow vector is then generated. The modified vector is then input into a classification model to generate a score. This score is adjusted based on the overflow vector and can then be provided to a consuming application or process. Related apparatus, systems, techniques and articles are also described.