FIG. 3 is a flowchart for a method of intelligently securing a data protection system against security threats, under some embodiments, and specifically illustrates protecting data using SVM-based machine learning mechanisms. To utilize the algorithm, the process 120 uses a labeled dataset is required as input. Each instance or observation within the dataset is labeled with its corresponding category or class.

As shown in FIG. 3, process 300 begins with gathering labeled data, 302, which includes data related to past security threats, their impact, and the associated remediation steps. While the features or attributes that describe each instance may be either continuous or discrete, they are typically converted to discrete values before being used with the algorithm.

In an embodiment, the data is labeled with threat labels and healing labels, among other possible labels. For threat labels, each data instance or sample is assigned a threat label indicating the specific type of security threat it represents. For example, the labels could include “0” for non-threat instances and “1” for instances representing a security threat. Alternatively, multiple threat classes can be assigned labels such as “2” for malware, “3” for intrusion attempts, “4” for data breaches, and so on. Similarly, data instances can be labeled with healing or remedial action labels to specify the appropriate response when a particular threat is detected. The healing labels could be encoded as numeric values, where each value represents a specific action or solution. For instance, “0” could indicate no action required, “1” could indicate isolating the affected system, “2” could represent initiating a system scan, and so on.

The labeling process is typically done to assign the appropriate numeric labels based on the predefined threat and healing categories. These labels serve as the ground truth for training the SVM model, allowing it to learn the patterns and relationships between input data and the corresponding threat and healing actions. During the training phase, the SVM model learns to classify new, unlabeled data instances by identifying the decision boundary that separates different threat classes. It uses the labeled data to optimize this boundary and make accurate predictions on unseen data. By labeling the data with threat and healing action codes, the SVM model can effectively detect and respond to security threats within a data protection product.

The data can be collected from various sources, such as internal modules, threat intelligence feeds, security logs, and so on. This step can be done using the DBSCAN or other similar scan process, as described above. Once the data is collected, it is preprocessed to convert it into a feature set that can be used by the SVM algorithm. The next step 304 is to train the SVM model using the preprocessed data. The SVM model learns from the labeled data and creates a decision boundary that separates the security threats from the non-threats. This decision boundary is optimized to provide the highest classification accuracy. In an embodiment, this is a binary threshold in which a data item is classified as either a threat or non-threat.

In an embodiment, the model 208 as trained in step 304 is trained with a large amount historical security data generated by the customers across a substantial period of time (e.g., on the order of several decades). Various different attributes, as cited above are used to train the model. In general, the model can be trained using text and data mining (TDM) or machine-reading processes that involve analyzing and extracting information from vast quantities of data used as training material. In an embodiment, any appropriate body of data can be used as historical data. For example, large-scale enterprises may rely on a large, long established customer base (e.g., up to 100,000s of customers over decades) to generate historical data that can provide insights into data growth, integrity, risk vulnerability, coverage, self-protection capabilities, and similar information. This can then be used to train the ML model. In addition to this actual user data, theoretical use or simulations performed in lab conditions can also be used. In some cases industry standard datasets may also be used if appropriate in particular use cases to train the model. The historical data set may be comprised of numerical data, categorical data, time-series data, and text data, providing a comprehensive and varied range of data for training the model.

Data mining processes such as TDM use automated computational techniques to analyze large amounts of information to identify patterns, trends and other useful information. The collected data can also be conditioned by processes that clean the text data to remove inconsistent, unreliable or redundant data, and to normalize the data into a specific format adapted to the relevant application. For example. Such normalization can involve reducing its randomness to conform to predefined standards and improve efficiency. Other similar data collection and conditioning processes may also be used to produce a suitable model 208.

In an embodiment, the process 300 receives and processes the collected data item by analyzing a pattern of threat embodied in the data, 306. Thus, once the SVM model is trained, it can be used to classify new data as either a security threat or a non-threat, 308. The SVM algorithm takes in the features of the new data item and calculates its distance from the decision boundary. Based on this distance, the SVM algorithm assigns the new data to one of the two classes, i.e., threat or non-threat.

In process 300, a data item classified as a non-threat is disregarded, and the system processes the next data item for classification, 310. If an input data item has been analyzed and classified as a threat, process 300 matches the data item against the model to identify the list of threats and associated solutions, 310.

With respect to the pattern matching process, the input data item is analyzed and categorized as a threat, using the SVM machine learning model to identify the list of threats and their respective associated solutions. This process starts with classification, where the SVM model is employed to classify the input data item as a threat. By leveraging the patterns and decision boundaries learned during training, the SVM model determines the appropriate threat category. Next, threats are mapped to solutions: Once the threat classification is obtained, the model maps it to the corresponding set of solutions. These associations are established during the training phase of the SVM model and are used to link threats with their appropriate remedial actions. The process then identifies associated solutions. Through the mapping process, the SVM model retrieves the associated solutions that are aligned with the identified threat category. These solutions are selected based on the patterns and correlations learned by the model during training. By executing these steps, the SVM machine learning model facilitates the identification of threats and their corresponding solutions when analyzing an input data item. This framework enables efficient threat mitigation and resolution based on the capabilities of the SVM model.

In an embodiment, various issues constituting actual or potential threats can be listed together along with known or potential solutions in a database. Alternatively, issues can be listed along with procedures to rectify the issues that may comprise combinations of steps, and which can be implemented as scripts or executable routines/sub-routines.

For this embodiment, the various issues constituting actual or potential threats can be listed in a database along with known or potential solutions. This leads to a correlation between the identified threats and the corresponding solutions, and by this linkage, the system aims to address and mitigate the potential risks effectively. Furthermore, the solutions can be implemented in the form of scripts or executables. This implies that the solutions are actionable and can be executed programmatically to rectify the identified issues. The use of scripts or executables allows for automated implementation, making the process more efficient and scalable.

In the context of using SVM machine learning model, it is likely that the threats and solutions are classified or predicted using this model. SVM can be trained to classify the threats and provide corresponding solutions based on patterns and features extracted from the data. By leveraging the capabilities of SVM, the system can accurately map threats to their appropriate solutions, providing a reliable and efficient mechanism to address security issues.

In step 312, the process categorizes the pattern matched threat based on a severity measure and the required actions for remediation. Threats can be categorized as High/Medium/Low severity, Severe/Not_Severe, and similar severity rankings based on the type of threat. The categorization can also take into account the possible remedy or solution. In an embodiment, there are three categories of threat issues that are classified. The first category is self-healable issues, where the SVM model detects a threat and takes automated steps to fix the issue. These steps are predefined in the training dataset and include actions such as taking a backup of data, removing the problematic code (e.g. virus or ransomware), and applying known steps, KBAs (Knowledge-based articles), or documentation to resolve the issue. For example, if the SVM model detects ransomware in the customer environment, it will take a copy of the data, remove the ransomware, and apply the existing steps from the training data to fix the issue.

The second category is manual fixing by the user. In this case, the SVM model detects a threat but cannot automatically remediate the issue. Instead, the model provides recommendations and guidance to the user on how to fix the issue manually. For example, if the SVM model detects a malware attack that requires specific user action to fix, it will provide instructions to the user on how to perform the required steps to remediate the issue.

The third category is escalation to the solution provider or vendor. In this case, the SVM model detects a threat that cannot be fixed by the customer or the SVM model. The customer is then advised to escalate the issue to the solution provider or vendor, who can provide further assistance in resolving the issue. For example, if the SVM model detects a product defect in a vendor product that is causing a security threat, the customer is advised to contact the vendor for further support.

Various different responses can be instigated based on the severity classification and possible solution, such as simply issuing a warning, automatically initiating a best solution, shutting down the system to prevent theft or permanent data loss, escalating to vendor customer service, and so on. For the embodiment of FIG. 3, process 300 determines whether or not the threat is severe, and if so automatically applies a matched solution 316 to resolve the threat 318. In some cases, the automatic execution of remedial solutions may be disruptive to the system or even entail its own possible issues, such as suspending backup/restore operations, forcing data copying, restricting user access, and so on. If the threat is not severe, as determined in step 314, the system may be configured to display a warning to the user to prompt appropriate user-initiated responses, 320. A smart solution 322 may also be initiated, which is generally a response that minimizes impact to the system, but still resolves the threat. Alternatively, or in addition, the system may be configured to provide suggestions of solutions to be undertaken by the system, 324 in order to resolve the threat, 318.

Process 300 illustrates an overall method in which an SVM model is used to detect and fix a wide range of security threats, including malware attacks and MITM attacks. The severity and required actions for remediation are classified into a number (e.g., three) of categories, with the SVM model providing automated, manual, or escalation-based solutions depending on the nature of the threat. FIG. 3 illustrates one example process for detecting, categorizing, and addressing a threat, and embodiments are not so limited. Depending on system configuration and applications, threats classified into different threat levels besides the binary threat/non_threat classifications, pattern matching can be based on any trained model data, and the severity of a classified threat can be categorized into any appropriate severity level with any practical solution associated with each matched threat.

For the embodiments of FIGS. 2 and 3, the classifier comprises an SVM classifier using SVM algorithm attempts to create the best line or decision boundary that can segregate n-dimensional space into classes so that a new data point ca be put in the correct category in the future. This best decision boundary is called a hyperplane, and SVM chooses the extreme points/vectors that help in creating the hyperplane, where these extreme cases are called as support vectors.

Besides the SVM algorithm, the classifier may use other AI-based classification methods. One such method is the KNN-based classification algorithm. The KNN (K-Nearest Neighbors) algorithm is a non-parametric, lazy learning method that classifies data based on the similarity of features between neighboring instances. The algorithm calculates the distance between the new instance and its K nearest neighbors in the training set to determine the class label. KNN is simple to implement and works well when there is a lot of training data, but it can be computationally expensive and slow for large datasets.

With respect to the KNN, process, KNN basically stands for k-nearest neighbors (KNN) algorithm, and is a classification algorithm that can be well used in case of classification and regression scenarios. KNN is a supervised learning algorithm that is dependent upon the labelled input data to study a function that would produce an output when a new unlabeled data is given as input. It classifies the data point on how its neighbor is classified. The basic principle of this model is to classify any new input data based on the similarity measure of the data points which was stored earlier. As used herein, “supervised learning” refers to a subcategory of machine learning (ML) and artificial intelligence (AI) that is defined by the use of labeled datasets to train algorithms that to classify data or predict outcomes accurately.

For example, consider a dataset of fruits comprising coconuts and grapes. The KNN model will get trained with similar measures like shape, color, weight, etc. When some random fruit is processed, KNN will try to match its similarity with the color (red or yellow), weight and shape. A similar process can be used with the properties of data object that are used to tailor the KNN model to fit the data protection embodiment. Any new error message processed by the system can be classified into a known error type certain defined attributes or patterns. In this process, ‘K’ in KNN signifies the number of the nearest neighbors that would be leveraged to classify new data points (e.g., new Virtual Machines/Docker/any data object).