Threat Actor Profiling for AI Malicious Activity Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional cybersecurity techniques for detecting malicious activities often result in a high number of false positives, diverting resources away from genuine threats.
Innovation Solution
Utilizing AI models with threat actor profiles, including natural language or computer code prompts, to analyze potentially anomalous events and determine the likelihood of malicious activity by comparing threat actor attributes with event data, reducing false positives and increasing accuracy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional techniques are used for detecting malicious activities, then detection coverage is maintained, but false positives increase substantially
Solution Approach 1:
The system performs preliminary actions by generating comprehensive threat actor profiles that include motivations, targets, and TTPs before analyzing suspicious events. This preliminary profiling enables more accurate matching and reduces false positives during the actual detection phase, as the AI model has pre-established contextual knowledge about threat actor behavior patterns.
Solution Approach 2:
The patent introduces an intermediary AI model that acts as a mediator between raw security event data and detection conclusions. The AI model receives suspicious events and threat actor profiles as input, processes them through natural language processing and embedding comparison, and produces more accurate detection results with reduced false positives, thereby improving overall measurement precision.
2Measurement precision
If AI models with threat actor profiles are used, then detection precision increases, but system complexity increases
Solution Approach 1:
The patent implements a universal AI model that performs multiple functions: generating threat actor profiles, analyzing suspicious events, comparing embeddings, and producing detection results. This multi-functional approach consolidates what would otherwise require separate systems for each task, managing complexity while maintaining high detection precision through a single integrated intelligent system.
Solution Approach 2:
The system manages complexity by changing parameters from traditional structured data comparison to natural language processing and embedding vector comparison. By transforming threat actor profiles and suspicious events into semantic embeddings, the system achieves higher detection precision through AI while managing complexity through parameter transformation rather than through complex rule-based systems.
3Measurement precision
If comprehensive threat actor profiles are generated, then false positives are reduced, but information processing requirements increase
Solution Approach 1:
The patent extracts only the most relevant features and characteristics from raw security data to create condensed threat actor profiles. Instead of processing all available data, the system identifies and extracts key attributes such as motivations, targets, and TTPs, then represents them as embeddings. This extraction approach reduces the quantity of data that needs to be processed while maintaining the ability to reduce false positives through comprehensive profiling.
Solution Approach 2:
The system creates simplified embedding representations (copies) of complex threat actor profiles and suspicious events. These embedding vectors serve as compressed copies that capture the essential semantic meaning without requiring processing of the full original data. This copying mechanism enables comprehensive profile analysis with reduced computational requirements for data processing.
Data Source
AI summary
Techniques are described herein that are capable of performing AI-based malicious activity detection using a threat actor profile. An alert is received. The alert indicates that a potentially anomalous event has occurred with regard to an entity. A profile of a threat actor is generated using information that describes behavior of the threat actor. An artificial intelligence (AI) model is triggered to determine whether the threat actor performs a malicious activity with regard to the entity by providing an AI prompt as an input to the AI model. The AI prompt includes the profile of the threat actor and a description of the potentially anomalous event. The AI prompt requests a determination whether the threat actor performs the malicious activity with regard to the entity.