Information Processing Device for Real-Space Attack Sample Generation

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing techniques for generating attack samples that avoid detection are inefficient when applied to high-dimensional and nonlinear feature spaces, making it difficult to find attacks that can exist in the real space and evade detection.

Innovation Solution

An information processing device that extracts true positive accesses identified as attacks and modifies their features using true negative accesses identified as normal, to create samples that evade detection.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Productivity

If existing techniques modify feature vectors to cross decision boundaries, then attack samples can be generated, but the method is inefficient in high-dimensional and nonlinear feature spaces

Engineering Contradiction:
Improveefficiency of generating attack samplesVSAvoidcomplexity of feature space
Core Design Contradiction:
ProductivityVSDevice complexity

Solution Approach 1:

The patent introduces an autoencoder as an intermediary model that learns to map high-dimensional and nonlinear feature vectors to a lower-dimensional latent space. This intermediary representation simplifies the feature space, making it easier to generate attack samples by modifying latent vectors and then decoding them back to the original feature space, thereby improving efficiency without losing the ability to represent complex attack patterns.

Inventive Principle:
Principle #24Intermediary (Mediator)

2Extent of automation

If AI is applied to detect cyber-attacks, then automated detection can be achieved, but large amounts of attack data are required for learning

Engineering Contradiction:
Improveautomation of attack detectionVSAvoidquantity of attack data
Core Design Contradiction:
Extent of automationVSQuantity of substance

Solution Approach 1:

The patent applies preliminary action by using the autoencoder to pre-process and transform real attack data into synthetic attack samples. The autoencoder learns the underlying patterns and distributions of attack data during training, then generates additional synthetic attack samples that preserve these patterns. This preliminary transformation enables the system to create sufficient training data without requiring large quantities of actual attack data.

Inventive Principle:
Principle #10Preliminary action

3Measurement precision

If attack data is increased to improve AI learning, then detection accuracy can be improved, but the sophistication of attack data must also increase to avoid detection

Engineering Contradiction:
Improvedetection accuracyVSAvoidsophistication of attack
Core Design Contradiction:
Measurement precisionVSObject-affected harmful factors

Solution Approach 1:

The patent uses copying by generating synthetic attack samples that replicate the patterns and characteristics of real attack data. The autoencoder learns from a small set of real attack samples and creates multiple synthetic copies that preserve the essential features of actual attacks. These synthetic copies provide diverse training examples without requiring increasingly sophisticated real attack data, thereby improving detection accuracy while maintaining a manageable level of attack sophistication.

Inventive Principle:
Principle #26Copying

Data Source

PatentUS12407698B2Information processing device, information processing method, and computer readable medium
Publication Date: 2025.09.02 MITSUBISHI ELECTRIC CORP
  • US12407698B2 patent drawing
  • US12407698B2 patent drawing
  • US12407698B2 patent drawing

AI summary

A normal classification unit (101) extracts a true positive access that is known to be an access aimed to attack and that has been determined by a detection unit (102) to be an access aimed to attack. A modification unit (107) modifies a feature of the true positive access by using a feature of a true negative access that is known to be a normal access and that has been determined by the detection unit (102) to be a normal access.