In-Situ Malware Classifier Retraining for Secure Local Adaptation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing machine learning techniques fail to address the need for augmenting or retraining classifiers based on data not accessible to the original trainer, and malware sensors are vulnerable due to identical deployments, allowing malware authors to evade detection by testing against a single signature set.
Innovation Solution
A method for batched, supervised, in-situ machine learning classifier retraining that allows users to create unique models by combining user-driven confirmation or correction of existing models with local data, using a combination of original and supplemental training sets, and enabling secure sharing of abstracted sample representations.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If a static training set is used for machine learning classification, then the model training is simple and fast, but the model cannot adapt to new malware patterns and has high false positive rates
Solution Approach 1:
The patent implements dynamic model retraining by periodically updating the classification model with new training samples collected from the deployment environment. The system transitions from a static training set to a dynamic one that evolves over time, allowing the model to adapt to new malware patterns while maintaining training efficiency through batch-based updates rather than continuous retraining.
Solution Approach 2:
The system performs preliminary actions by collecting and pre-processing training samples in the background before they are needed for model updates. Training data is accumulated and prepared in advance, allowing the actual model retraining to occur efficiently when scheduled, thus maintaining both adaptability and training speed.
2Reliability
If in-situ retraining with local data is implemented, then unique tailored models are created reducing false positives, but data security and privacy concerns arise
Solution Approach 1:
The patent applies local quality by allowing each deployment instance to have its own unique classification model trained on local organizational data. Each organization's specific data characteristics, network patterns, and threat landscape are captured in locally-trained models, reducing false positives caused by generic classification rules while maintaining data security through federated learning approaches.
Solution Approach 2:
The system uses feature vectors as an intermediary representation that captures essential characteristics of training data without exposing the actual sensitive data. By sharing and processing feature vectors instead of raw data, the system enables model improvement while maintaining data privacy and security boundaries between organizations.
3Adaptability or versatility
If feature vectors are used to represent training data, then data sharing is enabled without exposing sensitive information, but information loss occurs during abstraction
Solution Approach 1:
The system extracts only the essential features needed for classification by converting raw training data into feature vectors. This extraction process removes sensitive and redundant information while retaining the discriminative characteristics necessary for malware detection, enabling safe data sharing without exposing proprietary information or suffering excessive information loss.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A system and method for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity. The method produces a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations, adjudicates the class determination of the parent classifier over the plurality of the samples evaluated by the in-situ retraining system or systems, determines a minimum number of adjudicated samples required to initiate the in-situ retraining process, creates a new training and test set using samples from one or more in-situ systems, blends a feature vector representation of the in-situ training and test sets with a feature vector representation of the parent training and test sets, conducts machine learning over the blended training set, evaluates the new and parent models using the blended test set and additional unlabeled samples, and elects whether to replace the parent classifier with the retrained version.