Processing labeled data in machine learning operations

Abstract

A system, method, and software for processing labeled data in machine learning operations can be used to determine whether to relabel labeled data. In some aspects, the method includes: obtaining, by an electronic device, a set of labeled data, where each of the labeled data includes a feature vector and a label; for each labeled data in the set of labeled data: processing the labeled data using a plurality of machine learning models to obtain a plurality of classification results, where each of the plurality of classification results is obtained by processing the feature vector of the labeled data using a different machine learning model in the plurality of machine learning models; and determining a label uncertainty score for the labeled data based on a difference between an average entropy score and an adjustment score; and determining whether to relabel one or more of the labeled data in the set of labeled data based on the label uncertainty score.

Description

Technical Field

[0001] This disclosure relates to processing labeled data in machine learning operations. Background Technology

[0002] In some implementations, machine learning is used to classify input data. For example, machine learning models can be used for malware detection to classify whether software code may contain malware and thus pose a security risk. Machine learning operations can also be used in image processing to classify the content of images, or in speech recognition to classify the text in audio data. Machine learning models can be used in other applications as well. Attached Figure Description

[0003] Figure 1 This is a schematic diagram showing an example system that determines the operation based on the implementation of the remarking.

[0004] Figure 2 This is a flowchart showing an example process for processing labeled data according to the implementation.

[0005] Figure 3 A high-level architecture block diagram based on the implemented computer is shown.

[0006] Similar reference numerals and names in the various figures indicate similar elements. Detailed Implementation

[0007] In some implementations, machine learning models are trained using labeled data. Labeled data includes tags that indicate a predetermined classification outcome. During training, the machine learning model processes the labeled data to adjust its parameters.

[0008] Therefore, high-quality training datasets are essential for developing high-performance machine learning models. On the other hand, inaccurately labeled data can lead to biased models, resulting in inaccurate predictions and negative impacts on products and user experience.

[0009] There are two sources of uncertainty in machine learning predictions: data uncertainty and knowledge uncertainty. Data uncertainty (sometimes also called symbolic uncertainty) refers to the uncertainty or variability inherent in the data itself. It can be caused by factors such as measurement errors, missing values, or outliers. On the other hand, knowledge uncertainty (also known as cognitive uncertainty) arises when the model lacks understanding or knowledge about the input data. Data uncertainty is inherent in the data and generally cannot be reduced by collecting more data, while knowledge uncertainty can be reduced by providing the model with more training data.

[0010] Active learning techniques can be used to separate these two sources of uncertainty and leverage knowledge uncertainty to prioritize unlabeled data. Labeling this prioritized data will provide the model with the most useful information, helping it make more accurate predictions. However, data uncertainty is underutilized and largely unexplored.

[0011] A major cause of data uncertainty is label noise. Therefore, one way to leverage data uncertainty is to detect mislabeled data and improve the quality of machine learning training data. In some cases, committee query (QBC) can be used to quantify knowledge uncertainty in active learning. QBC involves training multiple models or committees on a labeled training set. A high level of knowledge uncertainty is indicated when committee members disagree on the classification of data points.

[0012] In some implementations, QBC can also be used to estimate data uncertainty by considering the degree of inconsistency and the confidence level of the classification. For example, in the context of binary classification, machine learning models often output probabilities ranging from 0 to 1 to represent their confidence in assigning a data point to the positive class. In some cases, a probability of 0 indicates high confidence in the negative class, while a probability of 1 indicates high confidence in the positive class. When the model or committee member outputs a probability of 0.5, this probability value will indicate uncertainty or lack of confidence in classifying a data point as positive or negative.

[0013] In some implementations, automated algorithms can be used to verify label accuracy and select labeled data with a high probability of being mislabeled. The training dataset of the labeled data is used to train multiple machine learning models. The labeled data in the training dataset may include mislabeled data. For each labeled data point, a label uncertainty score can be determined based on the classification results generated by the multiple machine learning models. The label uncertainty score can be used to determine whether the labeled data is likely to be mislabeled. Mislabeled data can be corrected through automated label correction or submitted to domain experts for further review. Figure 1-3 The associated descriptions provide additional details about these implementations.

[0014] The techniques described herein produce one or more technical effects. For example, the method improves the accuracy of labeled data used to train machine learning models, and thus improves the performance of machine learning operations.

[0015] Figure 1 This is a schematic diagram illustrating an example system 100 that determines operations based on the implementation's execution remarking. At a high level, example system 100 includes a server 120 communicatively coupled to a network 110.

[0016] Example system 100 includes network 110. Network 110 represents an application, application set, software, software module, hardware, or combination thereof that can be configured to transmit data messages between entities in example system 100. Network 110 may include a wireless network, a wired network, the Internet, or a combination thereof. For example, network 110 may include one or more radio access networks (RANs), core networks (CNs), and the Internet. The RAN may include one or more radio access technologies. In some implementations, the radio access technology may be Global System for Mobile Communications (GSM), Interim Standard 95 (IS-95), Universal Mobile Telecommunications System (UMTS), CDMA2000 (Code Division Multiple Access), Evolved Universal Mobile Telecommunications System (E-UMTS), Long Term Assessment (LTE), Advanced LTE, 5G, or any other radio access technology. In some cases, the core network may be an Evolved Packet Core (EPC). The RAN is part of a wireless telecommunications system that implements radio access technologies such as UMTS, CDMA2000, 3GPP LTE, 3GPP LTE-A, and 5G.

[0017] Server 120 includes a relabeling analyzer 104. The relabeling analyzer 104 represents an application, application set, software, software module, hardware, or any combination thereof that executes on server 120 to determine whether to relabel the labeled data. In one example operation, the relabeling analyzer 104 acquires labeled data 140 and processes it through multiple machine learning models (e.g., machine learning models 122, 124, and 126). Each machine learning model generates a classification result for the labeled data 140 and sends the classification result to a label uncertainty calculation module 130. The label uncertainty calculation module 130 calculates a label uncertainty score based on the classification result. The label uncertainty calculation module 130 determines whether to relabel the labeled data 140 based on the label uncertainty score. Figure 2 The associated descriptions provide additional details about these implementations.

[0018] Server 120 can be implemented using one or more computers, computer servers, or cloud computing platforms.

[0019] In some cases, server 120 can be a software service platform for detecting whether software code is malicious. In these cases, the tagging data can include feature vectors and tags of the software code, which indicate whether the software code is benign or malicious.

[0020] Software code can be source code or binary code. During software development, source code can be created by programmers using a text editor or visual programming tools before compilation. Source code can be developed using human-readable programming languages ​​and can be stored in text files. Source code can be converted into binary software code that can be executed by a computer using an assembler or compiler.

[0021] Binary software code can include byte streams generated by compiling source code. Therefore, binary software code may not be in a human-readable format and may not be easily parsed or analyzed by humans.

[0022] Binary software code can be a configuration of object code, executable code, or bytecode. Object code is the product of a compiler outputting a sequence of statements or instructions in a computer language. Source code can be logically divided into multiple source files. Each source file is independently compiled into a corresponding object file containing the object code. Object code in object files is binary machine code, but it may not be intended to be executed. Object files may include incomplete references to external subroutines and placeholder addresses. During the linking process, these object files can be linked together to form an executable file containing executable code that can be executed on a computing device. During the linking process, the linker can read object files, resolve references between them, perform the final code layout in memory that determines the addresses for code frames and data blocks, fix placeholder addresses with real addresses, and write the executable file containing the executable code.

[0023] Bytecode, also known as portable code or p-code, is a set of instructions designed for efficient execution by a software interpreter. Bytecode consists of compact numeric codes, constants, and references (often numeric addresses) that encode the results of semantic analysis performed by the compiler, including things like the type, scope, and nesting depth of program objects. Bytecode comprises a set of instructions with one byte of opcodes followed by optional parameters. Intermediate representations such as bytecode can be implemented and output by programming languages ​​for easier interpretation, or used to reduce hardware and operating system dependencies by allowing the same code to run across different devices and platforms. Bytecode can often be executed directly on a virtual machine (p-code machine, i.e., the interpreter), or it can be further compiled into machine code for better performance. In some cases, binary software code encoded in a platform-independent language such as Java can be stored in bytecode format.

[0024] Although Figure 1The elements are displayed as various component parts, sections, or modules that implement various features and functions; however, these elements may appropriately include several submodules, third-party services, components, libraries, etc. Furthermore, the features and functions of various components can be appropriately combined into fewer components.

[0025] Figure 2 This is a flowchart illustrating an example process 200 for processing marked data, implemented according to an example. The process shown can be implemented as a computer program on one or more computers in one or more locations, wherein the systems, components, and technologies described below can be implemented. Example process 200 can be implemented by... Figure 1 One or more entities shown, or any other system or module that processes the tagged data, can be used to implement this. For example, process 200 can be implemented by a server (e.g., in...). Figure 1 The example process 200 is implemented using server 120 shown. It can also be implemented using additional, fewer, or different operations, which can be performed in the order shown or in a different order.

[0026] Example procedure 200 begins at 210, where a set of labeled data is obtained. Each data point in this set includes a feature vector and a label. The feature vector indicates the features of the data, and the label indicates the classification result of the data.

[0027] In one example, labeled data can be used to develop a machine learning model that detects whether software code might be malicious. In some cases, the labels can be binary; for example, a label for each data point could be set to "0"—indicating the code is benign—or set to "1"—indicating the code could be potentially malicious. In some cases, the number of classes for the labels can be more than two. For example, labels could be set to 0, 1, 2, and 3, indicating different levels of risk that the code is malicious.

[0028] For software code detection examples, the feature vector of the data can include information representing different characteristics of the software code. Examples of features include file size, file format, file type (e.g., binary or source code), associated operating system or programming environment, number of specific strings included in the code, code structure (e.g., instruction set order), signature, checksum, or other information that can be used to determine whether the software code is malicious. In some cases, the feature information of the software code discussed above can be obtained from metadata associated with the code, from preprocessing operations that scan the software code and automatically extract feature information from the code, or from both. Feature information can be encoded into vectors and flattened into a single feature vector.

[0029] At position 220, each labeled data point is processed by multiple machine learning models to obtain multiple classification results. Each machine learning model has been trained to perform classification on the data.

[0030] In some cases, multiple machine learning models can be of the same type but have different parameters. For example, each of the multiple machine learning models can be a neural network, but they can have different numbers of layers or neurons. In some cases, multiple machine learning models can have the same number of layers or neurons, but are developed using different sets of labeled data during training. In some cases, multiple machine learning models can include different types of machine learning models, such as support vector machines and neural networks. Alternatively or additionally, multiple machine learning models can include different types of neural networks, such as convolutional neural networks (CNNs), feedforward neural networks (FNNs), recurrent neural networks (RNNs), etc.

[0031] In some cases, multiple machine learning models can be generated using a virtual ensemble. A virtual ensemble can be formed based on a base machine learning model. Random parameters can be introduced to generate additional machine learning models from the base model. In one example, the base machine learning model is a neural network consisting of multiple layers, with each layer containing multiple neurons. For each neuron in the neural network, a random function can be used to determine whether the neuron is turned on or off. The random function can randomly return one of two results, "on" or "off". Default probabilities can be set. For example, if the default probability is set to 70%, the random function will return "on" with a 70% probability and "off" with a 30% probability. During each operation, the random function is executed for each neuron. If the random function returns "on", the neuron is used to process data. If the random function returns "off", the neuron is turned off and bypassed.

[0032] Virtual ensembles can include multiple such neural networks. These neural networks have the same structure, the same number of layers, the same number of neurons, and the same parameters for each neuron. However, due to the random function, different neurons will be turned on or off for each neural network during each operation, and therefore these neural networks will function effectively as different neural networks and can return different results. Using virtual ensembles reduces the complexity of training and developing different machine learning models.

[0033] During operation, for each labeled data point, each machine learning model processes the same feature vector of the labeled data to generate a classification result for the labeled data. Because these machine learning models are different, the classification results for the same labeled data can be different.

[0034] At 230, the label uncertainty score is determined for each labeled data point based on the classification result obtained at 230. The label uncertainty score is determined based on the difference between the average entropy score and the adjusted score.

[0035] The average entropy score can be calculated as follows:

[0036] In classification operations, Equation 1 can be used to calculate the entropy of the model:

[0037]

[0038] Where x represents the input feature vector, y represents the output class, and D represents the dataset used to train the respective models. K represents the number of models, and k (k = 1, ..., K) represents each of the K models. The prediction for model k is denoted as H k (y|x,D) represents the entropy for model k.

[0039] Equation 2 can be used to calculate the average entropy of K models:

[0040]

[0041] Adjusted scores indicate the degree of bias between the classification results produced by each model. In some cases, the degree of bias can be indicated by calculating the standard deviation of the classification results from each model. When classifying the same data, a higher adjusted score reflects a higher degree of inconsistency within the models. In some cases, a scaling factor can be applied to the adjusted score.

[0042] Equation 3 can be used to calculate the label uncertainty score:

[0043]

[0044] in Let std represent the average entropy determined at (2), and std represent the standard deviation function. Let represent the standard deviation of the classification result, and s represent the scaling factor. In some implementations, the scaling factor can be set to a value from 0.001 to 0.3.

[0045] In some cases, the scaling factor is determined based on the problem context, algorithm, and data. Scaling factors are typically less than 1. In one example, a trial range from 0.001 to 0.999 might be tested. Several candidate values ​​within this range can be selected using a logarithmic scale, such as 0.001, 0.005, 0.01, 0.05, 0.1, 0.5, etc. These candidate values ​​can be used in experiments to evaluate performance based on a performance metric. In some cases, the actual labeling error rate of the prioritized samples can be used as a performance metric. The higher the performance metric, the more accurate the formula with that particular scaling factor value will be in selecting samples with respect to label noise.

[0046] A higher label uncertainty score indicates higher data uncertainty because it reflects greater consistency within the models, with each model exhibiting lower confidence.

[0047] At 240, the label uncertainty score is used to determine whether one or more labeled data points in the labeled dataset should be relabeled. In some cases, for each labeled data point, as previously discussed, the label uncertainty score is calculated based on the classification results generated by different models using equations (1)-(3). A threshold can be configured. If the label uncertainty score for a particular labeled data point exceeds the threshold, that particular labeled data point can be determined to have higher data uncertainty. Alternatively or additionally, labeled data can be graded based on their label uncertainty scores. The configured percentage of labeled data points with the highest label uncertainty score (e.g., 1%) is determined to have higher data uncertainty and will be relabeled.

[0048] In some implementations, the notification can be generated after processing the tagged data set. This notification can be output at the server's user interface, sent to different devices, or a combination thereof. The notification can indicate tagged data with a tag uncertainty score exceeding a configured threshold. The notification may also include the tag uncertainty scores of this tagged data.

[0049] In some cases, tagged data with higher uncertainty is processed by a re-tagging operation to determine if the tagged data is correctly tagged. Re-tagging operations can include automated tagged operations to regenerate tags, submission to domain experts for further review, or both. For the software code detection example, re-tagging operations could include submitting software code corresponding to the tagged data to a server for virus checks, executing the software code in a controlled environment to determine if it is malicious, or other measures.

[0050] While software code detection is used as an example to illustrate the operation of determining the label uncertainty of labeled data, the process discussed in this disclosure can be used in other machine learning applications using labeled data for classification, such as image recognition, speech or audio recognition, language translation, or other applications.

[0051] Figure 3 This is a high-level architectural block diagram showing a computer 302 coupled to a network 350 according to an implementation. The description is merely one possible implementation of the subject matter and is not intended to limit this disclosure to a single implementation. Those skilled in the art will understand that the components consistent with this disclosure can be connected, combined, or used in alternative ways.

[0052] Network 350 facilitates communication between computer 302 and other devices. In some cases, a user (e.g., an administrator) can access computer 302 from a remote network. In these or other cases, network 350 can be a wireless or wired network. In some cases, a user can access computer 302 locally. In these or other cases, network 350 can also be a memory conduit, hardware connection, or any internal or external communication path between components.

[0053] Computer 302 includes a computing system configured to execute the algorithms described in this disclosure. For example, computer 302 can be used to implement... Figure 1 The server 120 shown is an example. In some cases, the algorithm can be implemented in executable computational code (e.g., C / C++ executable code). Alternatively or in combination, the algorithm can be implemented in an application (e.g., Excel). In some cases, computer 302 may include a standalone Linux system running a batch processing application. In some cases, computer 302 may include a mobile or personal computer running the application.

[0054] Computer 302 may include input devices, such as a keypad, keyboard, touchscreen, microphone, voice recognition device, or other device that can accept user information, and / or output devices that transmit information associated with the operation of computer 302, including digital data, visual and / or audio information, or GUI.

[0055] Computer 302 can be used as a client, network component, server, database, or other persistent device. In some implementations, one or more components of computer 302 can be configured to operate within a cloud-based environment.

[0056] At a higher level, computer 302 is an electronic computing device operable for receiving, transmitting, processing, storing, or managing data and information. Depending on some implementations, computer 302 may also include, or be communicatively coupled to, application servers, email servers, web servers, cache servers, streaming data servers, business intelligence (BI) servers, and / or other servers.

[0057] Computer 302 can receive requests from client applications (e.g., executed on user devices) via network 350 and respond to the received requests by processing the requests in appropriate software applications. Furthermore, requests can also be sent to computer 302 from internal users (e.g., from a command console or by another suitable access method), external or third parties, other automated applications, and any other suitable entity, individual, system, or computer.

[0058] Each component of computer 302 can communicate using system bus 303. In some implementations, any and / or all components (both hardware and / or software) of computer 302 can interface with each other and / or with interface 304 via system bus 303 using application programming interfaces (APIs) 312 and / or service layer 313. API 312 may include specifications for routines, data structures, and object classes. API 312 may be computer language-independent or dependent and refers to a complete interface, a single function, or even a set of APIs. Service layer 313 provides software services to computer 302. The functionality of computer 302 is accessible to all service consumers using this service layer. Software services such as those provided by service layer 313 provide reusable, defined business functions through defined interfaces. For example, an interface may be software written in JAVA, C++, or other suitable languages ​​that provide data in Extensible Markup Language (XML) format or another suitable format. Although shown as an integrated component of computer 302, alternative implementations may show API 312 and / or service layer 313 as independent components relative to other components of computer 302. Furthermore, any or all portions of API 312 and / or service layer 313 may be implemented as child modules or submodules of another software or hardware module without departing from the scope of this disclosure.

[0059] Computer 302 includes interface 304. Although in Figure 3The interface 304 is shown as a single interface 304, but two or more interfaces 304 may be used depending on the specific needs, configuration, or implementation of the computer 302. Interface 304 is used by the computer 302 to communicate with other systems (whether shown or not) in a distributed environment connected to the network 350. Typically, interface 304 includes logic coded in software and / or hardware in a suitable combination and operable to communicate with the network 350. More specifically, interface 304 may include software supporting one or more communication protocols associated with the communication, such that the hardware of the network 350 or the interface is operable to communicate physical signals.

[0060] Computer 302 includes processor 305. Although in Figure 3 The processor 305 is shown as a single processor 305, but two or more processors may be used depending on the specific needs, configuration, or implementation of the computer 302. Typically, processor 305 executes instructions and manipulates data to perform operations on the computer 302. In some cases, processor 305 may include data processing means.

[0061] Computer 302 also includes memory 306 for storing data relating to computer 302. Although in Figure 3 The memory 306 is shown as a single memory 306, but two or more memories may be used depending on the specific needs, configuration, or implementation of the computer 302. Although the memory 306 is shown as an integrated component of the computer 302, in alternative implementations, the memory 306 may be external to the computer 302.

[0062] Application 307 includes an algorithmic software engine that provides functionality based on the specific needs, configuration, or implementation of computer 302. Although shown as a single application 307, application 307 can be implemented as multiple applications 307 on computer 302. Furthermore, although shown as integrated into computer 302, in alternative implementations, application 307 can be external to computer 302.

[0063] There may be any number of computers 302 associated with or outside of system 300 and communicating via network 350. Furthermore, the terms "client," "user," and other suitable terms may be used interchangeably without departing from the scope of this disclosure. Moreover, this disclosure contemplates that a number of users may use one computer 302, or that one user may use multiple computers 302.

[0064] The implementation of the subject content may include one or more features, individually or in combination.

[0065] For example, in a first implementation, a method includes: acquiring a set of labeled data by an electronic device, wherein each labeled data includes a feature vector and a label; for each labeled data in the set of labeled data: processing the labeled data using multiple machine learning models to obtain multiple classification results, wherein each of the multiple classification results is obtained by processing the feature vector of the labeled data using different machine learning models among the multiple machine learning models; determining a label uncertainty score of the labeled data based on the difference between an average entropy score and an adjusted score; and determining, based on the label uncertainty score, whether to relabel one or more labeled data in the set of labeled data.

[0066] The above and other implementations may each optionally include one or more of the following features:

[0067] The first feature is that it can be combined with any of the following features, wherein the adjusted score is determined based on the standard deviation of the classification results of the labeled data.

[0068] The second feature is combinable with any of the previous or subsequent features, wherein the adjusted score is further determined based on a scaling factor.

[0069] The third feature is that it can be combined with any of the preceding or following features, wherein each piece of labeled data in the labeled data represents software code, and the label indicates whether the software code is potentially malicious.

[0070] The fourth feature is composable with any of the previous or subsequent features, where multiple machine learning models are part of a virtual ensemble.

[0071] The fifth feature, which is composable with any of the preceding or following features, involves each neuron in multiple machine learning models being associated with a random function that returns an indicator to indicate whether the neuron is on or off.

[0072] The sixth feature, which is composable with any of the previous features, includes determining whether to relabel one or more labeled data, which involves comparing the label uncertainty score of one or more labeled data with a configuration threshold.

[0073] In a second implementation, a computer-readable medium containing instructions that, when executed, cause a computing device to perform operations, including: acquiring labeled data, wherein each labeled data includes a feature vector and a label; for each labeled data in a set of labeled data: processing the labeled data using multiple machine learning models to obtain multiple classification results, wherein each classification result among the multiple classification results is obtained by processing the feature vector of the labeled data using different machine learning models among the multiple machine learning models; determining a label uncertainty score of the labeled data based on the difference between an average entropy score and an adjusted score; and determining, based on the label uncertainty score, whether to relabel one or more labeled data in the set of labeled data.

[0074] The preceding and other implementations may each optionally include one or more of the following features:

[0075] The first feature is that it can be combined with any of the following features, wherein the adjusted score is determined based on the standard deviation of the classification results of the labeled data.

[0076] The second feature is combinable with any of the previous or subsequent features, wherein the adjusted score is further determined based on a scaling factor.

[0077] The third feature is that it can be combined with any of the preceding or following features, wherein each piece of labeled data in the labeled data represents software code, and the label indicates whether the software code is potentially malicious.

[0078] The fourth feature is composable with any of the previous or subsequent features, where multiple machine learning models are part of a virtual ensemble.

[0079] The fifth feature is composable with any of the previous or subsequent features, wherein each neuron in multiple machine learning models is associated with a random function that returns an indicator to indicate whether the neuron is on or off.

[0080] The sixth feature, which is composable with any of the previous features, includes determining whether to relabel one or more labeled data, which involves comparing the label uncertainty score of one or more labeled data with a configured threshold.

[0081] In a third implementation, an electronic device includes: one or more computers; and one or more computer memory devices interoperably coupled to the one or more computers and having a tangible, non-transient machine-readable medium storing one or more instructions, which, when executed by the one or more computers, perform one or more operations, including: acquiring a set of labeled data, wherein each labeled data in the labeled data includes a feature vector and a label; for each labeled data in the labeled data set: processing the labeled data using multiple machine learning models to obtain multiple classification results, wherein each of the multiple classification results is obtained by processing the feature vector of the labeled data using different machine learning models in the multiple machine learning models; determining a label uncertainty score of the labeled data based on the difference between an average entropy score and an adjusted score; and determining whether to relabel one or more labeled data in the labeled data set based on the label uncertainty score.

[0082] The preceding and other implementations may each optionally include one or more of the following features:

[0083] The first feature is that it can be combined with any of the following features, wherein the adjusted score is determined based on the standard deviation of the classification results of the labeled data.

[0084] The second feature is combinable with any of the previous or subsequent features, wherein the adjusted score is further determined based on a scaling factor.

[0085] The third feature is that it can be combined with any of the preceding or following features, wherein each piece of labeled data in the labeled data represents software code, and the label indicates whether the software code is potentially malicious.

[0086] The fourth feature is composable with any of the previous or subsequent features, where multiple machine learning models are part of a virtual ensemble.

[0087] The fifth feature is composable with any of the previous or subsequent features, wherein each neuron in multiple machine learning models is associated with a random function that returns an indicator to indicate whether the neuron is on or off.

[0088] The sixth feature, which is composable with any of the previous features, includes determining whether to relabel one or more labeled data, which involves comparing the label uncertainty score of one or more labeled data with a configured threshold.

[0089] The implementation of the subject matter and functional operations described herein can be implemented in digital electronic circuits, in tangibly embodied computer software or firmware, in computer hardware including the structures disclosed herein and their equivalents, or in a combination of one or more of these. The implementation of the subject matter described herein can be implemented as one or more computer programs, i.e., one or more modules of computer program instructions encoded on a tangible, non-transient computer storage medium for execution by a data processing device or for controlling the operation of a data processing device. Alternatively or additionally, the program instructions can be encoded on artificially generated propagation signals (e.g., machine-generated electrical, optical, or electromagnetic signals) generated for execution by the data processing device to encode information for transmission to a suitable receiver device. The computer storage medium can be a machine-readable storage device, a machine-readable storage substrate, a random or serial access storage device, or a combination of one or more of these.

[0090] The terms "data processing apparatus," "computer," or "electronic computer equipment" (or equivalents as understood by one of ordinary skill in the art) refer to data processing hardware and include all kinds of means, devices, and machines for processing data, including, for example, programmable processors, computers, or multiple processors or computers. The apparatus may also be or include special-purpose logic circuitry, such as a central processing unit (CPU), a field-programmable gate array (FPGA), or an application-specific integrated circuit (ASIC). In some implementations, the data processing apparatus and / or special-purpose logic circuitry may be hardware-based and / or software-based. The apparatus may optionally include code that creates an execution environment for computer programs, such as code constituting processor firmware, a protocol stack, a database management system, an operating system, or a combination of one or more of these. This disclosure contemplates the use of data processing apparatuses with or without a conventional operating system, such as LINUX, UNIX, WINDOWS, MACOS, ANDROID, IOS, or any other suitable conventional operating system.

[0091] A computer program, also referred to or described as a program, software, software application, module, software module, script, or code, can be written in any form of programming language, including compiled or interpreted languages, or declarative or procedural languages, and can be deployed in any form, including as a standalone program or as a module, component, subroutine, or other unit suitable for use in a computing environment. A computer program may, but does not necessarily, correspond to a file in a file system. A program may be stored as a portion of a file containing other programs or data, such as in a markup language document, in a single file dedicated to the program in question, or as one or more scripts in multiple collaborating files, for example, a file storing one or more modules, subroutines, or code portions. A computer program can be deployed to execute on one or more computers located at a single site or distributed across multiple sites and interconnected by a communications network. Although the parts of the program shown in the various figures are depicted as separate modules implementing various features and functions through various objects, methods, or other processes, the program may suitably include several submodules, third-party services, components, libraries, etc. Conversely, the features and functions of various components may be suitably combined into a single component.

[0092] The processes and logic flows described in this specification can be executed by one or more programmable computers that execute one or more computer programs to perform functions by manipulating input data and generating output. These processes and logic flows can also be executed by special-purpose logic circuitry (e.g., CPU, FPGA, or ASIC), and the apparatus can also be implemented as special-purpose logic circuitry.

[0093] A computer suitable for executing computer programs can be based on a general-purpose or special-purpose microprocessor, both, or any other type of CPU. Typically, the CPU receives instructions and data from ROM or RAM, or both. The basic elements of a computer are a CPU for executing or carrying out instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include, or be operatively coupled to, one or more mass storage devices (e.g., disks, magneto-optical disks, or optical disks) for storing data, receiving data from, or transferring data to, or both. However, a computer does not necessarily need to have such a device. Furthermore, a computer can be embedded in another device, such as a mobile phone, PDA, portable audio or video player, game console, GPS receiver, or portable storage device (e.g., a USB flash drive), to name just a few.

[0094] Computer-readable media (transient or non-transient, as the case may be) suitable for storing computer program instructions and data include all forms of non-volatile memory, media, and memory devices, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), and flash memory devices; disks, such as internal hard disks or removable disks; magneto-optical disks; and CD-ROMs, DVD+ / -Rs, DVD-RAMs, and DVD-ROM discs. Memory can store a variety of objects or data, including caches, classes, frames, applications, backup data, jobs, web pages, web page templates, database tables, repositories storing business and / or dynamic information, and any other suitable information, including any parameters, variables, algorithms, instructions, rules, constraints, or references to them. Additionally, memory may include any other suitable data, such as logs, policies, security or access data, report files, and others. Processors and memory may be supplemented by or incorporated into dedicated logic circuitry.

[0095] To provide user interaction, the subject matter described in this specification can be implemented on a computer having a display device for displaying information to the user (e.g., a CRT (cathode ray tube), LCD, LED, or plasma monitor), and a keyboard and clicking device (e.g., a mouse, trackball, or trackpad) from which the user can provide input to the computer. Input can also be provided to the computer using a touchscreen, such as a pressure-sensitive tablet computer surface, a multi-touchscreen using capacitive or inductive sensors, or other types of touchscreens. Other types of devices can also be used to provide user interaction; for example, feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and input from the user can be received in any form, including sound, speech, or tactile input. Furthermore, the computer can interact with the user by sending and receiving documents to and from devices used by the user; for example, by sending a webpage to a web browser on the user's client device in response to a request received from a web browser.

[0096] The term "graphical user interface" or "GUI" can be used in the singular or plural to describe one or more graphical user interfaces and each display in a particular graphical user interface display. Therefore, a GUI can represent any graphical user interface, including but not limited to web browsers, touchscreens, or command-line interfaces (CLIs) that process information and effectively present the results to a user. Typically, a GUI may include multiple user interface (UI) elements, some or all of which are associated with a web browser, such as interactive fields, dropdown lists, and buttons operable by the business suite user. These and other UI elements may relate to or represent the functionality of the web browser.

[0097] The implementation of the subject matter described in this specification can be implemented in a computing system that includes back-end components (e.g., a data server), or middleware components (e.g., an application server), or front-end components (e.g., a client computer with a graphical user interface or web browser through which a user can interact with the implementation of the subject matter described in this specification), or any combination of one or more such back-end, middleware, or front-end components. The components of the system can be interconnected by any form or medium of wired and / or wireless digital data communication (e.g., a communication network). Examples of communication networks include local area networks (LANs), radio access networks (RANs), metropolitan area networks (MANs), wide area networks (WANs), global interoperability for microwave access (WIMAX), WLANs using, for example, 802.11a / b / g / n and / or 802.20, all or part of the Internet, and / or any other communication systems or systems in one or more locations. The network can communicate with, for example, Internet Protocol (IP) packets, Frame Relay frames, Asynchronous Transfer Mode (ATM) cells, voice, video, data, and / or other appropriate information between network addresses.

[0098] A computing system may include clients and servers. Clients and servers are typically geographically separated and usually interact via a communication network. The client-server relationship arises from computer programs running on their respective computers and having client-server relationships with each other.

[0099] In some implementations, any or all components (hardware and / or software) of a computing system can use APIs and / or service layers to interface with each other and / or interface with each other. APIs may include specifications for routines, data structures, and object classes. APIs can be computer language-independent or computer language-dependent and refer to a complete interface, a single function, or even a set of APIs. The service layer provides software services to the computing system. The functionality of the various components of the computing system is accessible to all service consumers via this service layer. Software services provide reusable, defined business functions through defined interfaces. For example, an interface may be software written in JAVA, C++, or other suitable languages ​​that provide data in XML or other suitable formats. The API and / or service layer can be integrated and / or independent components relative to other components of the computing system. Furthermore, any or all portions of the service layer may be implemented as child modules or submodules of another software module, enterprise application, or hardware module without departing from the scope of this disclosure.

[0100] While this specification contains numerous specific implementation details, these should not be construed as limiting the scope of any invention or any possible scope of claims, but rather as descriptions of features that may be specific to a particular invention. Some features described in this specification in the context of individual implementations may also be implemented in combinations within a single implementation. Conversely, various features described in the context of a single implementation may also be implemented individually or in any suitable sub-combination in multiple implementations. Furthermore, while features may function in certain combinations as described above and even initially claimed, in some cases one or more features from the claimed combination may be removed from that combination, and the claimed combination may refer to a sub-combination or a variation of a sub-combination.

[0101] Specific implementations of the subject matter have been described. Other implementations, alternatives, and substitutions of the described implementations are within the scope of the appended claims and will be apparent to those skilled in the art. Although operations are described in a specific order in the drawings or claims, this should not be construed as requiring these operations to be performed in the specific order shown or in a sequential order, or to perform all of the shown operations (some operations may be considered optional) to achieve the desired result. In some cases, multitasking and parallel processing may be advantageous.

[0102] Furthermore, the separation and / or integration of the various system modules and components in the above-described implementations should not be construed as requiring such separation and / or integration in all implementations, and it should be understood that the program components and systems can typically be integrated together in a single software product or packaged into multiple software products.

[0103] Therefore, the above description of the exemplary embodiments does not define or limit this disclosure. Other changes, alternatives, and modifications are possible without departing from the spirit and scope of this disclosure.

Claims

1. A computer-implemented method, comprising: A set of (210) labeled data (140) is obtained, wherein each labeled data in the labeled data includes a feature vector and a label, wherein each labeled data in the labeled data represents software code, and the label indicates whether the software code is potentially malicious; For each piece of labeled data in the set (140) of labeled data: The labeled data (220) is processed by multiple machine learning models (122, 124, 126) to obtain multiple classification results, wherein each of the multiple classification results is obtained by processing the feature vector of the labeled data by different machine learning models (122, 124, 126); The label uncertainty score of the labeled data is determined based on the difference between the average entropy score and the adjusted score, wherein the adjusted score is determined based on the standard deviation of the classification result of the labeled data; Based on the label uncertainty score, determine (240) whether to relabel one or more labeled data in the set (140) of labeled data; The labeled data is corrected and relabeled in the set of labeled data by submitting it to domain experts for further examination; The corrected set of labeled data is used to train a machine learning model for detecting whether software code is malicious.

2. The method of claim 1, wherein the adjusted score is further determined based on a scaling factor.

3. The method according to any of the preceding claims, wherein the plurality of machine learning models (122, 124, 126) are part of a virtual ensemble.

4. The method of claim 3, wherein each neuron in the plurality of machine learning models (122, 124, 126) is associated with a random function that returns an indicator to indicate whether the neuron is on or off.

5. The method according to any preceding claim, wherein determining whether to relabel the one or more labeled data in the set (140) of labeled data based on the labeled uncertainty score comprises: Compare the tag uncertainty score of the one or more tag data with the configured threshold.

6. A computer-readable medium comprising instructions that, when executed by a computing device (302), cause the computing device (302) to perform the method according to any one of claims 1 to 5.

7. An electronic device (302), comprising: One or more computers; as well as One or more computer memory devices (306) interoperably coupled to the one or more computers and having a tangible, non-transient machine-readable medium storing one or more instructions, which, when executed by the one or more computers, cause the one or more computers to perform the method according to any one of claims 1 to 5.

Images