Gradient-Boosted Malware Detection with Incremental Tree Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Gradient boosting trees are prone to overfitting and computationally expensive, and full retraining of the model can lead to errors and inefficiencies in detecting malicious files due to the creation of new malware families over time.
Innovation Solution
A method for rapidly retraining a gradient-boosted decision model by removing some decision trees from an initial model, computing classification scores, and adding further trees based on new data to create an augmented model that preserves the model's knowledge in well-performing areas while addressing local issues.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If full retraining of the gradient-boosted decision model is performed, then the model can be updated with new data, but computational expense increases and model errors may occur
Solution Approach 1:
The patent segments the model into an initial set of decision trees and an augmented set of decision trees. Instead of retraining the entire model, only the augmented set is trained on new data while the initial set is retained. This segmentation allows selective updating of only the necessary portion of the model, reducing computational expense while maintaining adaptability to new data.
Solution Approach 2:
The patent applies partial action by training only the augmented set of decision trees on new data rather than performing a full retraining of the entire model. This partial action approach updates the model with new information while avoiding the computational burden of complete model regeneration, thus balancing adaptability with computational efficiency.
2Measurement precision
If the model is trained on new data, then detection accuracy may improve, but the model may introduce errors in detecting malicious files
Solution Approach 1:
The patent segments the model into an initial set of decision trees that maintain established detection patterns and an augmented set of decision trees that learn from new data. This segmentation allows the model to preserve reliable detection capabilities from the initial training while incorporating improvements from new data, thus maintaining reliability while enhancing accuracy.
Solution Approach 2:
The patent applies local quality by training the augmented set of decision trees specifically on new data to address local issues or emerging threats, while the initial set of decision trees continues to handle well-performing areas. This localized approach allows the model to improve detection accuracy for specific cases without compromising overall reliability.
3Adaptability or versatility
If gradient boosting trees are used for malicious file detection, then complex relationships can be captured, but the model becomes computationally expensive and hard to parallelize
Solution Approach 1:
The patent segments the gradient-boosted decision model into an initial set of decision trees that capture complex relationships from historical data and an augmented set that handles new data. This segmentation allows the model to maintain the ability to capture complex feature relationships while reducing computational complexity by only training the augmented set on new data rather than retraining the entire model.
Data Source
AI summary
A method, including receiving first files, having respective first labels, and extracting respective first features from the files. A model including a set of decision trees is trained based on the respective features and labels of the files. Some but not all of the trees in the set are removed from the model so as to define an abridged model including an abridged set of the trees. Upon receiving second files, which are different from the first files and have respective second labels, respective second features are extracted from the second files, and respective classification scores are computed for the first and the second files by applying the abridged model. An augmented model is trained by adding further trees to the abridged set based on the respective scores and respective labels and features of the first and the second files, and the augmented model is applied to classify further files.