Security Appliance Dynamic Function Selection via Threat Prediction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing security devices face inefficiencies in determining whether an unknown object is malicious, as they often execute multiple security functions, wasting computing resources and requiring only a subset to effectively identify threats.
Innovation Solution
A security device employs a threat prediction model to identify a subset of security functions to execute on an unknown object, determining predicted threat scores, utility values, and costs to efficiently determine if the object is malicious, dynamically updating the model based on features and threat scores.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If multiple security functions are executed on an unknown object, then threat detection accuracy is improved, but computing resource consumption increases
Solution Approach 1:
The patent implements dynamic selection of security functions based on real-time analysis of object features and predicted threat scores. The system adapts which security functions to execute by evaluating predicted efficiencies that combine threat scores with cost estimates, allowing the security appliance to dynamically adjust its analysis depth and resource allocation based on the specific characteristics of each scanned object.
Solution Approach 2:
The system changes the parameter of security function selection by using predicted threat scores and predicted efficiencies as dynamic parameters. Instead of executing a fixed set of security functions, the system adjusts which functions are executed based on calculated parameters that reflect both threat level and resource cost, optimizing the balance between detection accuracy and resource consumption.
2Productivity
If a subset of security functions is selected based on predicted efficiency, then computing resource efficiency is improved, but threat detection reliability may worsen
Solution Approach 1:
The system incorporates feedback mechanisms where the results of executed security functions are used to update predicted threat scores and predicted efficiencies for subsequent objects. The actual threat scores obtained from executing security functions feed back into the machine learning model, allowing the system to learn from past performance and improve its predictions, thereby maintaining reliability while optimizing resource efficiency.
Solution Approach 2:
The system performs preliminary action by calculating predicted threat scores and predicted efficiencies before executing security functions. This preliminary analysis allows the system to pre-determine which security functions are most likely to be effective based on object features, ensuring that resources are allocated to the most promising detection methods while maintaining comprehensive coverage through the selection process.
3Reliability
If all security functions are executed on every object, then comprehensive threat detection is achieved, but processing time increases
Solution Approach 1:
The system applies partial action by executing only the necessary subset of security functions for each object based on predicted efficiency calculations. Instead of applying all security functions uniformly to every object, the system determines the appropriate level of analysis needed for each specific object, performing partial execution of the security function set while maintaining comprehensive detection capabilities when threats are identified.
Solution Approach 2:
The patent segments the security function execution process into distinct phases: preliminary feature extraction, predicted threat score calculation, predicted efficiency determination, and selective security function execution. This segmentation allows the system to process objects through different stages, applying comprehensive analysis only when predicted efficiencies indicate high threat potential, thereby reducing overall processing time while maintaining detection completeness.
Data Source
Figure 1A
Figure 1B
Figure 1C
AI summary
A device may identify a set of features associated with the unknown object. The device may determine, based on inputting the set of features into a threat prediction model associated with a set of security functions, a set of predicted threat scores. The device may determine, based on the set of predicted threat scores, a set of predicted utility values. The device may determine a set of costs corresponding to the set of security functions. The device may determine a set of predicted efficiencies, associated with the set of security functions, based on the set of predicted utility values and the set of costs. The device may identify, based on the set of predicted efficiencies, a particular security function, and may cause the particular security function to be executed on the unknown object. The device may determine whether another security function is to be executed on the unknown object.