Agent-driven TRIZ method improves cybersecurity detection scores
$\mathrm{TRIZ}^{a}$: Guiding Agent Evolution from Pattern Recognition to Solution Invention
Artificial Intelligence
Summary
Finding new solutions for tough problems is tricky, especially in fast-changing areas like cybersecurity. The paper introduces TRIZ^a, a method that uses a computer program guided by a theory called TRIZ to evolve better solutions by following structured ideas rather than random changes. They tested this approach on cybersecurity tasks and saw measurable improvements in identifying threats. The method also explains how each improvement was achieved, making it easier to trust and understand.
What this means in practice
- •For cybersecurity engineers: Improve malware and attack detection models by evolving solutions guided by structured inventive principles for better accuracy and explainability.
- •For software developers: Use TRIZ^a to systematically evolve software code to meet changing requirements with traceable and theory-driven modifications.
Authors
Wenyin Liu, Yiheng Huang, Kai Wang
Abstract
We propose $\mathrm{TRIZ}^{a}$ (TRIZ exponentiated by an agent), a general R\&D automation paradigm that combines TRIZ inventive theory with LLM-driven agent evolutionary search. TRIZ's 40 inventive principles and contradiction matrix provide structured, explainable directions for solution generation, replacing random or untyped mutation with theory-guided ideation. Functional information (FI), operationalized under a frozen reference contract, is combined with TRIZ Ideality to measure useful and harmful function on a commensurable information scale, while hard gates keep promotion distinct from metric improvement. We validate $\mathrm{TRIZ}^{a}$ in cybersecurity--an adversarial and rapidly evolving domain--on PowerDuck GOOSE, CICIoT2023, and CIC-DDoS2019. Under paired-rerun protocols with protocol fingerprinting and hard-gate validation, the legacy experiments yield absolute F1 improvements of $+2.88$, $+4.23$, and $+0.15$ percentage points, respectively. A completed 45-activity CICIoT2023 campaign further increases macro-F1 from $0.8325$ to $0.8483$, but does not pass its frozen promotion gate. Every result remains traceable from contradiction identification and TRIZ principle selection to code transformation, evaluation metrics, and promotion decision.