System and method for heterogeneous transferred learning for enhanced cybersecurity threat detection
A method includes training a first machine learning model with a first dataset, to produce a first trained machine learning model to infer cybersecurity-oriented file properties and/or detect cybersecurity threats within a first domain. The first dataset includes labeled files associated with the first domain. The first trained machine learning model includes multiple layers, some of which are trainable. A second trained machine learning model is generated, via a transfer learning process, using (1) at least one trainable layer from the multiple trainable layers of the first trained machine learning model, and (2) a second dataset different from the first dataset. The second dataset includes labeled files associated with a second domain. The first domain has a different syntax, different semantics, and/or a different structure than that of the second domain. The second trained machine learning model (e.g., a deep neural network model) is then available for use in inferring cybersecurity-oriented properties of the file in the second domain and/or detecting cybersecurity threats in the second domain.
1 . A method for training machine learning models for cybersecurity threat detection, the method comprising:
training a first machine learning model with a first dataset including labeled files associated with a first domain, to produce a first trained machine learning model, the first trained machine learning model including a plurality of trainable layers; and
generating a second trained machine learning model via a transfer learning process using (1) at least one trainable layer from the plurality of trainable layers of the first trained machine learning model, and (2) a second dataset different from the first dataset, the second dataset including labeled files associated with a second domain;
wherein the second domain is a cybersecurity-oriented domain;
wherein the second trained machine learning model is configured to infer cybersecurity-oriented file properties within the second domain; and
wherein the first domain has at least one of a different syntax, different semantics, or different structure than that of the second domain.
2 . The method of claim 1 , wherein the second trained machine learning model is configured to perform malware classification.
3 . The method of claim 1 , wherein the second trained machine learning model is configured to perform malware categorization.
4 . The method of claim 1 , wherein the second trained machine learning model is configured to perform file authorship identification.
5 . The method of claim 1 , wherein the first trained machine learning model is configured to infer cybersecurity-oriented file properties within the first domain.
6 . The method of claim 1 , wherein the first domain comprises a natural language domain.
7 . The method of claim 1 , wherein the first domain comprises Windows portable executable (PE) (WinPE) files associated with a Windows operating system.
8 . The method of claim 7 , wherein the second domain comprises files associated with a second operating system that is different from the Windows operating system.
9 . The method of claim 7 , wherein the second domain comprises executable files associated with a Unix operating system.
10 . The method of claim 1 , wherein the second dataset is smaller than the first dataset.
11 . The method of claim 1 , further comprising analyzing a labeled file associated with the second domain, using the second trained machine learning model, to determine a cybersecurity risk associated with the labeled file.
12 . The method of claim 1 , further comprising selecting the at least one trainable layer from the plurality of trainable layers of the first trained machine learning model based on a resource constraint of a compute device.
13 . A method for training machine learning models for cybersecurity threat detection, the method comprising:
receiving, at a machine learning system associated with a second domain, a first trained machine learning model trained on training data associated with a first domain different from the second domain;
training the first trained machine learning model via a transfer learning process using a dataset including labeled files associated with the second domain to produce a second trained machine learning model configured to infer cybersecurity-oriented file properties for files associated with the second domain; and
analyzing a labeled file associated with the second domain, at the machine learning system and using the second trained machine learning model, to determine a cybersecurity risk associated with the labeled file.
14 . The method of claim 13 , wherein the second trained machine learning model is configured to perform malware classification.
15 . The method of claim 13 , wherein the first domain comprises a natural language domain.
16 . The method of claim 13 , wherein the first domain comprises Windows portable executable (PE) (WinPE) files associated with a Windows operating system.
17 . The method of claim 16 , wherein the second domain comprises files associated with a second operating system that is different from the Windows operating system.
18 . The method of claim 16 , wherein the second domain comprises executable files associated with a Unix operating system.
19 . The method of claim 16 , wherein the second domain comprises executable files associated with a MacOS operating system.
20 . One or more non-transitory computer-readable media that collectively store instructions for performing operations, the operations comprising:
receiving, at a machine learning system associated with a second domain, a first trained machine learning model trained on training data associated with a first domain different from the second domain;
training the first trained machine learning model via a transfer learning process using a dataset including labeled files associated with the second domain to produce a second trained machine learning model configured to infer cybersecurity-oriented file properties for files associated with the second domain; and
analyzing a labeled file associated with the second domain, at the machine learning system and using the second trained machine learning model, to determine a cybersecurity risk associated with the labeled file.