Utility-Driven Graph Summarization for Malicious Application Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Graph summarization techniques, such as collapsing nodes into supernodes and edges into superedges, can reduce the size of large security graphs but may compromise their utility for network security applications, leading to data loss and reduced effectiveness in detecting malicious applications.
Innovation Solution
A utility-driven graph summarization method that prioritizes nodes based on relative importance, combines them into supernodes, calculates utility penalties for superedge creation, and iteratively adjusts the graph until a pre-determined utility threshold is met, ensuring the summarized graph maintains sufficient utility for detecting and preventing malicious applications.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If graph summarization is applied to reduce the size of the security graph, then computational efficiency is improved, but data loss occurs and utility for security detection deteriorates
Solution Approach 1:
The patent changes the parameters of graph summarization by introducing utility-based node prioritization and controlled summarization. Instead of uniform node collapsing, the system assigns utility scores to nodes based on their security relevance and selectively summarizes only low-utility nodes, thereby maintaining data integrity for critical security information while achieving compression for computational efficiency.
Solution Approach 2:
The patent applies different summarization strategies to different parts of the graph based on local utility characteristics. High-utility nodes (those critical for security detection) are preserved in detail, while low-utility nodes are aggressively summarized. This local differentiation ensures that security-critical data is retained while non-critical data is compressed to improve computational efficiency.
2Device complexity
If graph summarization is applied to reduce the size of the security graph, then device complexity is reduced, but utility for security detection deteriorates
Solution Approach 1:
The system changes the summarization parameters by introducing utility thresholds and controlled collapsing ratios. By adjusting these parameters, the system can control the degree of summarization to maintain graph utility for security detection while reducing graph size. The utility-based approach ensures that summarization does not compromise the detection capability.
Solution Approach 2:
The patent introduces dynamic adaptability by allowing the summarization process to adjust based on utility metrics. The system can dynamically determine which nodes to summarize or preserve based on their utility scores, and can adapt the summarization intensity to maintain minimum utility thresholds for effective security detection.
3Device complexity
If nodes are collapsed into supernodes and edges into superedges, then the graph becomes more concise, but detection precision deteriorates due to data loss
Solution Approach 1:
The patent applies differential treatment to different nodes and edges based on their utility for security detection. Critical nodes and edges are preserved with full detail to maintain detection precision, while non-critical elements are summarized to achieve conciseness. This local quality approach ensures that precision is maintained where it matters most for security detection.
Solution Approach 2:
The system introduces utility-based parameters to control the summarization process. By setting utility thresholds and prioritization weights, the system can control which nodes and edges are collapsed and which are preserved, thereby maintaining detection precision for security-critical relationships while achieving overall graph conciseness.
Data Source
AI summary
Utility driven graph summarization for use in detecting and preventing malicious computer application. In one embodiment, a method may include receiving a graph comprising a plurality of nodes and a plurality of edges, prioritizing each of the plurality of nodes by way of assigning a relative importance value to each node of the plurality of nodes, combining at least two nodes of the plurality of nodes into a supernode based at least on the relative importance value of each node, calculating a utility penalty value for creating a superedge between the supernode and a node neighboring the supernode, creating the superedge between the supernode and the node neighboring the supernode if the utility penalty value satisfies a pre-determined penalty threshold, calculating a utility level based at least in part on creating the supernode and the superedge, and repeating the method until the calculated utility level satisfies a pre-determined threshold.