Small LLM Domain Classification via Quantization and Attention
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems struggle to efficiently and accurately identify new, uncategorized domains as malicious or benign, due to latency and coverage issues in threat intelligence feeds, leading to poor user experience and ineffective protection against evolving malicious sites.
Innovation Solution
The use of optimized small-sized Large Language Models (LLMs) for domain classification, which involves training machine learning models with optimizations such as 4-bit quantization, bfloat16 memory, flash attention mechanisms, and Rotation Positional Encoding (RoPE), to classify domains and predict their likelihood of being malicious or benign.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threat intelligence feeds are used for domain classification, then coverage of known malicious sites is improved, but latency increases and new malicious sites are not detected
Solution Approach 1:
The system performs preliminary classification of uncategorized domains using machine learning models before threats are added to intelligence feeds. By proactively analyzing domains upon first encounter rather than waiting for feed updates, the system detects new malicious sites immediately while maintaining low latency for user requests.
2Reliability
If all new uncategorized sites are blocked, then protection against malicious sites is improved, but user experience deteriorates due to blocking legitimate sites
Solution Approach 1:
The system uses machine learning models to analyze uncategorized domains and provide probabilistic classifications with feedback mechanisms. Rather than blanket blocking, the system evaluates each domain's characteristics, provides risk assessments, and adjusts classifications based on accumulated data, allowing legitimate sites to pass while blocking malicious ones with high accuracy.
3Measurement precision
If detailed analysis of uncategorized sites is performed, then classification accuracy is improved, but latency increases leading to poor user experience
Solution Approach 1:
The system performs partial analysis of uncategorized domains using optimized machine learning models that process only the most critical features first. This selective approach achieves sufficient classification accuracy for immediate decision-making without performing exhaustive analysis that would cause unacceptable latency, with further analysis occurring asynchronously in the background.
4Ease of operation
If no protection is provided for uncategorized sites, then user experience is improved by allowing all sites, but effectiveness against malicious sites deteriorates
Solution Approach 1:
The system implements self-service protection where machine learning models automatically classify uncategorized domains in real-time without requiring user intervention or manual configuration. This automated classification provides immediate security protection while maintaining seamless user experience, as the system independently evaluates and decisions on each uncategorized domain encountered.
Data Source
AI summary
Systems and methods for utilizing small sized Large Language Models (LLMs) for performing domain classification include responsive to training one or more machine learning models for performing classification of domains, the training including performing one or more optimizations to the one or more machine learning models, receiving a domain; obtaining data associated with the domain including log data from a cloud-based system that performs monitoring of a plurality of users; and analyzing the domain via the one or more trained machine learning models for classifying the domain.