Weak Learner Aggregation for Threat Detection

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current cybersecurity systems face challenges in efficiently processing and validating high volumes of security events from multiple sources, with varying severity and methods of assignment, leading to increased manual work for SOC teams, and difficulties in identifying malicious entities due to short-lived network infrastructure and inconsistent threat detection across vendors.

Innovation Solution

The implementation of a method using weak learner models and link aggregation to analyze network interactions, forming bipartite graphs to calculate maliciousness scores, and generating Adaptive Risk Map Graphs to identify high-risk nodes for investigation, providing scalable and accurate retrieval of malicious entities with understandable explanations.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If human review is performed for each candidate entity before adding to malicious list, then reliability of malicious entity identification is improved, but productivity of processing candidate entities deteriorates

Engineering Contradiction:

Improvereliability of malicious entity identificationVSAvoidproductivity of processing candidate entities

Core Design Contradiction:

ReliabilityVSProductivity

Solution Approach 1:

The system segments the review process by introducing multiple weak learner models that each analyze specific aspects of security events. These models divide the comprehensive review task into smaller specialized analyses, allowing parallel processing while maintaining thorough evaluation. The segmentation enables automated pre-filtering before human review, increasing throughput without sacrificing reliability.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

Weak learner models serve as intermediaries between raw security events and human reviewers. These models process and aggregate signals from multiple security products, transforming unstructured event data into structured assessments that guide human review. The intermediary layer filters and prioritizes candidates, reducing the volume requiring manual review while preserving reliability through multi-model aggregation.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Reliability

If multiple security products with different severity assignment methods are integrated, then comprehensiveness of threat detection is improved, but ease of operation deteriorates due to inconsistent severity evaluation

Engineering Contradiction:

Improvecomprehensiveness of threat detectionVSAvoidease of operation for SOC team

Core Design Contradiction:

ReliabilityVSEase of operation

Solution Approach 1:

The system creates a universal aggregation framework that handles multiple security products and their different severity assignment methods through a common interface. The weak learner models are designed to process diverse event formats and normalize them into a unified assessment structure. This multi-functional approach allows the system to accommodate various vendor methodologies while presenting consistent outputs to SOC teams.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The system transforms severity parameters from different vendors by applying learned transformations through weak learner models. Each model adjusts and normalizes severity assignments based on patterns observed across multiple products, converting inconsistent vendor-specific severity scales into a standardized assessment framework. This parameter transformation maintains comprehensiveness while improving ease of operation through consistent evaluation metrics.

Inventive Principle:

Principle #35Parameter changes

3Measurement precision

If all security events are processed manually by SOC team, then measurement precision of event severity is improved, but loss of time increases

Engineering Contradiction:

Improveprecision of event severity assessmentVSAvoidtime required for event processing

Core Design Contradiction:

Measurement precisionVSLoss of time

Solution Approach 1:

Weak learner models perform preliminary analysis and aggregation of security events before they reach human reviewers. The models pre-process events by analyzing multiple aspects, aggregating signals from different security products, and generating initial severity assessments. This preliminary action filters out low-priority events and pre-preps high-priority candidates, reducing the time required for manual processing while maintaining precision through structured analysis.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The system implements continuous automated analysis through weak learner models that operate on all incoming security events in real-time. Rather than batch processing, the models continuously aggregate signals and generate assessments as events arrive. This continuous useful action maintains measurement precision through consistent analysis while dramatically reducing loss of time by eliminating manual triage delays.

Inventive Principle:

Principle #20Continuity of useful action

Data Source

PatentUS20240356935A1Event-based threat detection with weak learner models data signal aggregation

Publication Date: 2024.10.24 CISCO TECHNOLOGY INC

AI summary

Techniques for identifying malicious threats for investigation using network telemetry data. The techniques include the use weak learner models to analyze data from multiple event sources. The techniques further include aggregating data signals from the weak learner models to generate a high-fidelity data signal of threat sources. The aggregated data signal can be sent to a Security Operation Center to provide a list of nodes with a high likelihood of malicious threats along with convicting evidence to aid in investigating the identified nodes.