Sample Data Generation for Anomaly Detection Accuracy

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Existing detection techniques for anomalous events, such as failures and attacks, face issues with false detections and missed detections due to insufficient sample data, and current methods fail to generate effective sample data for enhancing detection accuracy.

Innovation Solution

A sample data generation apparatus that acquires normal and anomalous event data, generates feature vectors, and modifies them to create non-normal changed vectors, which are verified to determine if they are detected by a detection device, storing missed-detection sample data when not detected and false-detection sample data when detected.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Measurement precision

If attack detection rules are defined based on features of malicious programs not included in normal programs, then detection accuracy for obvious attacks is improved, but sophisticated attackers can create malicious programs that perform malicious processing within the range of features of normal programs, causing missed detections

Engineering Contradiction:

Improvedetection accuracyVSAvoidability to detect sophisticated attacks

Core Design Contradiction:

Measurement precisionVSAdaptability or versatility

Solution Approach 1:

The invention performs preliminary action by generating sample data of sophisticated attacks (malicious programs within normal feature ranges) in advance before deploying detection rules. This allows the detection system to be trained and evaluated on these edge-case scenarios beforehand, improving its ability to detect attacks that blend in with normal programs.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The invention inverts the traditional approach by not only detecting what is malicious but also systematically generating examples of what should be detected but might be missed. Instead of only analyzing existing detection failures, it proactively creates sample data representing missed detection cases to improve the detection system.

Inventive Principle:

Principle #13The other way round (Inversion)

2Measurement precision

If sufficient sample data of normal events and anomalous events is prepared, then detection accuracy is improved, but the quantity and variety of required sample data increases significantly, making data preparation difficult

Engineering Contradiction:

Improvedetection accuracyVSAvoidquantity of sample data

Core Design Contradiction:

Measurement precisionVSQuantity of substance

Solution Approach 1:

The invention uses copying by generating artificial sample data through systematic transformation of existing data. Instead of collecting large quantities of real-world sample data, it creates copies and variations of available data by modifying features to represent different attack scenarios, normal variations, and edge cases, thereby achieving sufficient data quantity and variety through synthesis rather than collection.

Inventive Principle:

Principle #26Copying

3Reliability

If the technique generates malicious programs that are not detected by known products, then detection technique is enhanced, but it does not provide sample data of false detections and cannot detect malicious programs that perform malicious processing within the range of features of normal programs

Engineering Contradiction:

Improvedetection technique reliabilityVSAvoidloss of false detection sample data

Core Design Contradiction:

ReliabilityVSLoss of information

Solution Approach 1:

The invention implements feedback by systematically evaluating generated sample data against detection products and using the results to improve the detection system. It creates a closed loop where detection failures (both missed detections and false detections) are identified, analyzed, and used to generate improved sample data and refine detection rules, continuously enhancing detection reliability through iterative feedback.

Inventive Principle:

Principle #23Feedback

Data Source

PatentUS11797668B2Sample data generation apparatus, sample data generation method, and computer readable medium

Publication Date: 2023.10.24 MITSUBISHI ELECTRIC CORP

AI summary

An acquisition unit (10) acquires normal sample data and non-normal sample data. A model generation unit (120) generates a normal model representing the normal sample data. A change unit (141) generates a non-normal feature vector of the non-normal sample data, and generates a non-normal changed vector obtained by changing an element of the non-normal feature vector. When the non-normal changed vector and the normal model are similar to each other, a verification unit (142) executes a process using sample data represented by the non-normal changed vector. The verification unit (142) verifies whether an anomalous event is detected by a detection device. Upon verification that an anomalous event is not detected, the verification unit (142) determines whether an anomalous event is present, independently of the detection device. Upon determination that an anomalous event is present, the verification unit (142) stores the sample data represented by the non-normal changed vector as missed-detection sample data (154) in a storage unit (150).