Semi-Supervised Learning Framework for Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current machine learning approaches for detecting malicious activity in cybersecurity face challenges with unsupervised learning techniques, as they struggle to accurately identify malicious activity amidst abundant unlabeled data, especially when the positive rate is low, making manual labeling impractical and inefficient.
Innovation Solution
A framework that employs semi-supervised learning methods to generate calibrated classifiers and predictions by selecting samples with high confidence or disagreements, adapting the classification model to the natural distribution of data, and using active learning algorithms to identify informative samples for labeling, thereby transitioning from unsupervised to supervised learning.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If unsupervised learning techniques are used to detect malicious activity in abundant unlabeled data, then the system can operate without manual labeling, but the accuracy of identifying malicious activity is insufficient
Solution Approach 1:
The patent introduces an active learning component as an intermediary that selects informative samples from unlabeled data and obtains their labels through manual annotation. This intermediary bridge allows the system to operate primarily with unlabeled data while periodically incorporating labeled samples to train supervised classifiers, thereby resolving the contradiction between ease of operation and measurement precision
Solution Approach 2:
The system dynamically transitions between unsupervised and supervised learning modes. It starts with unsupervised learning to handle abundant unlabeled data, then actively selects samples to label, and iteratively retrains supervised classifiers with the accumulated labeled data. This dynamic adaptation allows the system to maintain high accuracy while minimizing manual labeling effort
2Measurement precision
If manual labeling is performed to improve classification accuracy, then the precision of malicious activity detection is improved, but the time and resources required increase significantly
Solution Approach 1:
The active learning component applies partial action by selecting only a small, informative subset of samples for manual labeling rather than labeling all unlabeled data. By strategically choosing samples that maximize information gain (e.g., high uncertainty samples), the system achieves significant precision improvement with minimal manual labeling time
Solution Approach 2:
The system implements feedback loops where classified samples are evaluated, and those with high uncertainty or disagreement are selected for manual labeling. The labeled samples then feedback into retraining the classifiers, creating an iterative improvement cycle that continuously enhances detection precision while controlling labeling time through intelligent sample selection
Data Source
AI summary
A method, including collecting communication sessions, and generating samples from the sessions. Classifiers are applied to the samples, thereby computing a classifier prediction for each sample, and based on the classifier predictions, respective aggregated predictions are determined for the samples. Based on the classifier and the aggregated predictions, a precision and a hit rate for each classifier and a positive rate are computed, and based on the aggregated predictions, a subset of the samples are selected. Using the selected subset, a model including the classifiers is computed based on the precisions, the hit rates and the positive rate, and the model is applied to the samples, thereby updating the classifier and the aggregate predictions. The steps of computing the precision and the hit rate, selecting the subset, computing the model and applying the model are repeated until meeting a halting condition, and using the model, additional communication sessions are scanned.