Threat Detection Risk Scoring With False Positive Counterweights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing threat detection systems generate excessive false positive alerts, wasting resources and exposing networks to potential threats by relying on whitelists that can be compromised, and do not effectively adjust risk scores for reliable objects.
Innovation Solution
Implement a counterweight algorithm that downscales risk scores for objects based on prior false positive alerts, using static or dynamic counterweights to reduce false positives and monitor all objects, rather than relying solely on whitelists.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If threat detection systems use whitelists to stop monitoring trustworthy objects, then false positive alerts are reduced, but security is compromised when whitelist objects are breached
Solution Approach 1:
The patent introduces a counterweight mechanism that applies negative weight to objects that trigger false positive alerts, downsampling their risk scores. This counterweights the harmful effect of false positives by reducing the risk score contribution from reliable objects, while maintaining monitoring without requiring whitelist exclusions.
2Object-affected harmful factors
If threat detection systems monitor all objects continuously, then security is maintained, but computing resources are wasted on false positive alerts from reliable objects
Solution Approach 1:
The patent implements dynamic risk score downsampling where the counterweight applied to an object varies based on its historical false positive rate. Objects with higher false positive rates receive greater downsampling, dynamically adjusting monitoring intensity to conserve resources while maintaining security for truly suspicious objects.
Solution Approach 2:
The system changes the risk score parameter for objects based on their reliability history. By modifying the risk score calculation to include counterweight factors, the system adjusts the effective monitoring threshold dynamically without changing the fundamental monitoring architecture.
3Measurement precision
If threat detection systems apply high risk scores to suspicious objects, then threat detection accuracy is improved, but false positive alerts increase for reliable objects
Solution Approach 1:
The patent implements a feedback loop where objects that trigger false positive alerts are identified and have their counterweights adjusted in subsequent evaluations. This feedback mechanism allows the system to learn from false positives and adjust risk scoring to reduce future false alerts while maintaining detection accuracy for genuine threats.
Data Source
AI summary
One example method includes determining, by a threat detection system and at a first time interval, for an object and based on a first risk score computed for the object, that the object poses a threat to the networked environment. Actual threat data indicating that the object does not pose an actual threat can be received. In response to receiving the actual threat data, a value of a first counter can be computed based on prior incorrect identification of the object as a threat. A counterweight can be identified based on the value of the first counter. A second risk score for the object can be downscaled, using the identified counterweight and at a second time interval, to obtain an updated risk score for the object. Access of the object to system resources can be controlled based on whether the updated risk score satisfies a predetermined risk threshold value.