Soft-Label Model Training for Cyber Incident Prioritization
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cybersecurity models trained with binary labels for user and entity behavior-related incidents often inaccurately prioritize incidents due to the sharp classification of activities as malicious or benign, failing to capture the nuanced suspiciousness levels.
Innovation Solution
A method and system that translate binary labels into soft labels using predefined labeling rules and fine-tuning functions to train a machine learning model, allowing for more accurate prioritization of cybersecurity incidents based on suspiciousness levels.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If binary labels are used to train the model, then the training process is simple and fast, but the model accuracy in prioritizing incidents deteriorates due to inability to capture nuanced suspiciousness levels
Solution Approach 1:
The patent transforms the label parameter from binary (0/1) to continuous soft labels (e.g., 0.2, 0.5, 0.8) that represent different levels of suspiciousness. This parameter change allows the model to learn nuanced risk assessments while maintaining training efficiency through automated label generation based on feature analysis.
Solution Approach 2:
The patent introduces soft labels as an intermediary between binary ground truth labels and model predictions. These soft labels serve as a bridge that captures intermediate suspiciousness levels, enabling the model to learn gradual risk assessments rather than abrupt binary classifications.
2Measurement precision
If soft labels are generated using multiple functions and rules, then the model accuracy improves, but the system complexity increases
Solution Approach 1:
The patent segments the soft label generation process into distinct modular functions: baseline label assignment, feature-based adjustment functions, and bounding operations. Each function handles a specific aspect of label generation, making the complex process manageable and maintainable while improving model accuracy.
Solution Approach 2:
The patent dynamically adjusts label parameters based on incident features using predefined functions. Features such as alert severity, entity reputation, and behavior anomaly scores modify the base soft label through controlled parameter changes, enabling accurate risk assessment without requiring complex manual labeling.
3Ease of operation
If binary classification is used, then the labeling process is straightforward, but the ability to capture nuanced suspiciousness levels deteriorates
Solution Approach 1:
The system performs self-service label generation by automatically computing soft labels from incident features and predefined rules. This eliminates the need for manual nuanced labeling while capturing suspiciousness levels, making the process as easy as binary labeling but with significantly improved precision.
Solution Approach 2:
Soft labels serve as an intermediary that automatically translates binary ground truth into nuanced suspiciousness levels through feature-based functions. This intermediary process maintains the simplicity of binary labeling input while producing precise multi-level labels for training.
Data Source
AI summary
A method for cybersecurity includes receiving a corpus of cyber incidents, each including (i) one or more alerts indicative of suspicious activities in one or more computer systems, and (ii) one or more features characterizing the cyber incident. Binary labels respectively assigned to the cyber incidents of the corpus are further received, each of the binary labels having a first value indicating the cyber incident is benign, or a second value indicating the cyber incident is malicious. Predefined labeling rules that map the binary labels to respective soft labels that are indicative of suspiciousness levels of the cyber incidents are held. The binary labels are mapped to respective soft labels, based at least on the predefined labeling rules. The cyber incidents of the corpus and the respective soft labels are provided for training a machine learning model that, when trained, predicts risk scores for cyber incidents outside the corpus.