Positive Unlabeled ML Classifiers for Network Device Compromise Detection

The patent introduces machine learning classifiers as an intermediary between alert generation and human investigation. These classifiers automatically process and prioritize alerts, acting as a mediator that filters the overwhelming volume of alerts into manageable priorities for security analysts.

The patent changes the parameter of alert prioritization from manual assessment to automated machine learning-based risk scoring. By transforming alerts into quantified risk scores through ML models, the system enables automated sorting and prioritization, dramatically increasing processing capacity.

The patent enables the system to self-prioritize alerts through automated machine learning classification. The ML models independently assess and rank alerts without human intervention, allowing the system to serve itself in the initial triage phase and freeing human analysts for complex investigations.

The patent performs preliminary classification and prioritization of alerts automatically before human investigators begin their work. By pre-processing alerts through ML classifiers and sorting them by risk score, the system prepares the investigation queue in advance, reducing the time analysts need to spend on initial assessment.

The patent replaces mechanical rules-based prioritization systems with intelligent machine learning models. Instead of relying on fixed thresholds and simple rules, the system uses ML classifiers that learn from data to accurately identify compromised devices, substituting rigid mechanical logic with adaptive intelligent processing.

The patent implements feedback loops where investigation outcomes and confirmed compromises are fed back into the training data for ML models. This continuous feedback mechanism allows the classifiers to learn from actual cases and improve their prioritization accuracy over time, becoming increasingly precise at identifying truly compromised devices.