URL Classifier Training with Filtered Pseudo Domain Data
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Pseudo data generated by GANs can be actual benign URLs/domains, leading to deteriorated classification performance and increased learning time for classifiers, even with large amounts of pseudo data.
Innovation Solution
A classification device that determines whether pseudo data generated by a generator is an existing benign URL/domain, and only adds data not identified as such to malicious learning data, using an annotator unit and active learning models to enhance classifier performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Quantity of substance
If pseudo data generated by GAN is used to expand malicious learning data, then the quantity of learning data increases, but the classification performance deteriorates because some pseudo data are actual benign URLs/domains
Solution Approach 1:
The system uses the trained classifier itself to evaluate and filter the pseudo data generated by GAN. The classifier determines whether each pseudo URL/domain is benign or malicious, and only malicious pseudo data is added to the learning dataset. This self-service mechanism ensures data quality while expanding quantity.
Solution Approach 2:
The system implements a feedback loop where the classifier's determination results are used to control the data addition process. The classifier evaluates pseudo data, and based on this feedback, only appropriately labeled data is added to the learning set, ensuring continuous improvement of classification performance.
2Quantity of substance
If a large amount of pseudo data is used for learning, then the quantity of learning data increases, but the learning time increases and classification performance may not be very high
Solution Approach 1:
The system changes the quality parameter of learning data by filtering pseudo data through the classifier. Instead of using all generated pseudo data uniformly, the system selectively adds only high-quality malicious pseudo data, improving the efficiency of the learning process and reducing unnecessary learning time.
3Measurement precision
If pseudo data similar to benign URLs/domains is generated by GAN, then the realism of pseudo data improves, but the risk of generating actual benign URLs/domains increases
Solution Approach 1:
The classifier serves itself by evaluating the pseudo data it will be trained on. It determines whether generated pseudo URLs/domains are benign or malicious, ensuring that only malicious pseudo data is added to the training set, thus eliminating the harmful effect of accidentally including real benign data.
Solution Approach 2:
The classifier acts as an intermediary between the GAN generator and the learning data repository. It mediates the addition of pseudo data by evaluating each candidate and deciding whether to add it to the malicious learning data, preventing direct contamination with benign URLs/domains.
Data Source
AI summary
A classification device includes processing circuitry configured to determine whether or not an input URL or domain is an existing benign URL or domain, output pseudo data determined not to be an existing benign URL or domain by the annotator unit among pseudo data of benign URLs or domains generated by a generator, add the pseudo data output by the data generation unit to learning data of a malicious URL or domain, and learn a classifier for classifying the input URL or domain as being malicious or benign using the learning data of the malicious URL or domain to which the pseudo data has been added.