Traffic Data Extraction Device for Malicious Traffic Classification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional techniques face challenges in obtaining sufficient feature amounts from traffic data, particularly due to the rarity of malicious traffic data, which can lead to decreased model accuracy for classification tasks.
Innovation Solution
An extraction device that processes traffic data to generate first and second feature vectors by aggregating data for predetermined targets, sampling traffic data multiple times, and discarding feature vectors that are too far from the original data, thereby increasing the number of feature amounts available for training and prediction models.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If traffic data is aggregated for each predetermined target to generate feature vectors, then model training becomes feasible, but the number of available feature amounts remains insufficient due to rarity of malicious traffic
Solution Approach 1:
The patent applies copying by generating multiple second feature vectors from a single first feature vector through feature amount reproduction processing. This creates synthetic copies of feature data that can be used for training without requiring additional actual malicious traffic data, thereby increasing the quantity of training features while maintaining reliability through controlled reproduction rather than random sampling
Solution Approach 2:
The patent applies preliminary action by pre-calculating and storing feature vectors from available traffic data before model training begins. The feature amount reproduction processing is performed in advance to generate multiple second feature vectors, so that when model training is needed, sufficient feature amounts are already prepared without requiring real-time data collection during the training process
Data Source
AI summary
An extraction device includes processing circuitry configured to generate a first feature vector that shows a feature of traffic data for each target from a plurality of traffic data pieces aggregated for each predetermined target, sample traffic data from the traffic data for each target a plurality of times, and generate a second feature vector that shows a feature of the sampled traffic data for each sample set obtained.