Retraining machine learning model for computer vulnerability exploitation detection
Systems and methods may be used to determine a computer vulnerability exploit via use of a machine learning model. Vulnerability content data may be received from one or more vulnerability feeds or data stores. The vulnerability content data may be categorized as either training data or inference data. A machine learning model may be trained based on the training data and then used to predict exploits of computer vulnerabilities identified in the inference data.
1 . A computer-implemented method, comprising:
retrieving a first set of data comprising computer vulnerability content data, wherein the first set of data identifies a plurality of computer vulnerabilities;
determining, using a first portion of the first set of data, first hyperparameters for a multilayer perceptron (MLP) model;
validating the first hyperparameters based on a second portion of the first set of data;
based at least in part on the first hyperparameters and a third portion of the first set of data, training the MLP model to determine a probability that computer vulnerabilities will be exploited;
testing the trained MLP model using a fourth portion of the first set of data;
detecting, using the trained MLP model, computer vulnerability exploits;
retrieving, after a predetermined period of time and without human intervention, a second set of data comprising computer vulnerability content data, wherein the second set of data is different from the first set of data; and
retraining, after the predetermined period of time and without human intervention, the trained MLP model, wherein retraining the trained MLP model comprises: modifying at least one hyperparameter of the first hyperparameters and retraining the trained MLP model using the at least one modified hyperparameter of the first hyperparameters and at least a portion of the second set of data,
wherein the predetermined period of time is less than or equal to one month.
2 . The computer-implemented method of claim 1 , wherein at least one of the first portion, second portion, third portion, or fourth portion of the first set of data comprises computer vulnerability content data determined, by a third party, to be exploited less than a threshold time period.
3 . The computer-implemented method of claim 1 , wherein at least one of the first portion, second portion, third portion, or fourth portion comprises computer vulnerability content data determined, by a third party, to be (i) exploited more than a threshold time period and (ii) less than two standard deviations of an error.
4 . The computer-implemented method of claim 1 , wherein at least one of the first portion, second portion, third portion, or fourth portion of the first set of data comprises computer vulnerability content data determined, by a third party, to be (i) exploited more than a threshold time period and (ii) more than two standard deviations of an error.
5 . The computer-implemented method of claim 1 , wherein at least one of the first portion, second portion, third portion, or fourth portion of the first set of data comprises computer vulnerability content data determined, by a third party, to be (i) not be exploited more than a threshold time period and (ii) be less than two standard deviations of an error.
6 . The computer-implemented method of claim 1 , wherein at least one of the first portion, second portion, third portion, or fourth portion of the first set of data comprises computer vulnerability content data determined, by a third party, to be (i) not be exploited more than a threshold time period and (ii) be more than two standard deviations of an error.
7 . The computer-implemented method of claim 1 , wherein the predetermined period of time is less than or equal to two hours.
8 . The computer-implemented method of claim 1 , wherein the first set of data is received as structured data, and wherein the first set of data is annotated prior to determining the first hyperparameters.
9 . The computer-implemented method of claim 1 , wherein the first hyperparameters are determined by a Keras Tuner.
10 . The computer-implemented method of claim 1 , wherein retraining the trained MLP model comprises retraining the trained MLP model based at least in part on a determination that a quantity of computer vulnerabilities added to the trained MLP model satisfies an added vulnerability threshold.
11 . The computer-implemented method of claim 1 , wherein retraining the trained MLP model comprises retraining the trained MLP model based at least in part on a determination that a quantity of vulnerabilities exploited since the trained MLP model was last trained satisfies a vulnerability exploitation threshold.
12 . A system, comprising:
a data store; and
one or more processors configured to:
retrieve a first set of data comprising computer vulnerability content data, wherein the first set of data identifies a plurality of computer vulnerabilities;
determine, using a first portion of the first set of data, first hyperparameters for a multilayer perceptron (MLP) model;
validate the first hyperparameters based on a second portion of the first set of data;
based at least in part on the first hyperparameters and a third portion of the first set of data, training the MLP model to determine a probability that computer vulnerabilities will be exploited;
test the trained MLP model using a fourth portion of the first set of data;
detect, using the trained MLP model, computer vulnerability exploits;
retrieve, after a predetermined period of time and without human intervention, a second set of data comprising computer vulnerability content data, wherein the second set of data is different from the first set of data; and
retrain, after the predetermined period of time and without human intervention, the trained MLP model, wherein to retrain the trained MLP model, the one or more processors are further configured to: modify at least one hyperparameter of the first hyperparameters and retrain the trained MLP model using the at least one modified hyperparameter of the first hyperparameters and at least a portion of the second set of data,
wherein the predetermined period of time is less than or equal to one month.
13 . The system of claim 12 , wherein at least one of the first portion, second portion, third portion, or fourth portion of the first set of data comprises computer vulnerability content data determined, by a third party, to be exploited less than a threshold time period.
14 . The system of claim 12 , wherein at least one of the first portion, second portion, third portion, or fourth portion comprises computer vulnerability content data determined, by a third party, to be (i) exploited more than a threshold time period and (ii) less than two standard deviations of an error.
15 . A non-transitory computer-readable media including computer-executable instructions that, when executed by a computing system, cause the computing system to:
retrieve a first set of data comprising computer vulnerability content data, wherein the first set of data identifies a plurality of computer vulnerabilities;
determine, using a first portion of the first set of data, first hyperparameters for a multilayer perceptron (MLP) model;
validate the first hyperparameters based on a second portion of the first set of data;
based at least in part on the first hyperparameters and a third portion of the first set of data, training the MLP model to determine a probability that computer vulnerabilities will be exploited;
test the trained MLP model using a fourth portion of the first set of data;
detect, using the trained MLP model, computer vulnerability exploits;
retrieve, after a predetermined period of time and without human intervention, a second set of data comprising computer vulnerability content data, wherein the second set of data is different from the first set of data; and
retrain, after the predetermined period of time and without human intervention, the trained MLP model, wherein to retrain the trained MLP model, the computer-executable instructions further cause the computing system to modify at least one hyperparameter of the first hyperparameters and retrain the trained MLP model using the at least one modified hyperparameter of the first hyperparameters and at least a portion of the second set of data,
wherein the predetermined period of time is less than or equal to one month.
16 . The non-transitory computer-readable media of claim 15 , wherein the first set of data comprising computer vulnerability content data is a first subset of computer vulnerability content data of a set of computer vulnerability content data.
17 . The non-transitory computer-readable media of claim 16 , wherein the first hyperparameters are first hyperparameters of a set of hyperparameters, wherein the computer-executable instructions further cause the computing system to:
determine that at least a portion of the first subset of computer vulnerability content data has changed;
based on the determining that the at least a portion of the first subset of computer vulnerability content data has changed, reassigning the at least a portion of the first subset of computer vulnerability content data to a second subset of computer vulnerability content data comprising second computer vulnerability content data thereby forming an updated first subset of computer vulnerability content data and an updated second subset of computer vulnerability content data;
retrain the trained MLP model using the updated second subset of computer vulnerability content data, wherein to retrain the trained MLP model, the computer-executable instructions further cause the computing system to, without human intervention, modify second hyperparameters of the set of hyperparameters and retrain the trained MLP model using the second modified hyperparameters; and
determine, using the retrained MLP model, at least one of a probability that a second particular computer vulnerability identified in the updated first subset of computer vulnerability content data will be exploited or a risk score associated with the second particular computer vulnerability.
18 . The non-transitory computer-readable media of claim 16 , wherein the computer-executable instructions further cause the computing system to:
determine that a threshold quantity of data has been added to the set of computer vulnerability content data thereby forming an updated set of computer vulnerability content data;
determine an updated first subset of computer vulnerability content data of the updated set of computer vulnerability content data based on a threshold time period, wherein the updated first subset of computer vulnerability content data does not satisfy the threshold time period;
determine an updated second subset of computer vulnerability content data of the updated set of computer vulnerability content data based on the threshold time period, wherein the updated second subset of computer vulnerability content data satisfies the threshold time period;
retrain, without human intervention the trained MLP model using the updated second subset of computer vulnerability content data, wherein to retrain the trained MLP model, the computer-executable instructions further cause the computing system to modify third hyperparameters of the set of hyperparameters and retrain the trained MLP model using the third modified hyperparameters; and
determine, using the retrained MLP model, at least one of a probability that a second particular computer vulnerability identified in the updated first subset of computer vulnerability content data will be exploited or a risk score associated with the second particular computer vulnerability.