Employing a relatively simple machine learning classifier to explain evidence that led to a security action decision by a relatively complex machine learning classifier
Employing a relatively simple machine learning classifier to explain evidence that led to a security action decision by a relatively complex machine learning classifier. In one embodiment, a method may include identifying training data, training a relatively complex machine learning classifier (MLC) using the training data, making a first security action decision using the relatively complex MLC, performing a security action on a network device based on the first security action decision, training a relatively simple MLC using the training data or using a subset of the training data, making a second security action decision using the relatively simple MLC, extracting evidence that led to the second security action decision by the relatively simple MLC, and explaining the first security action decision by the relatively complex MLC using the evidence extracted from the relatively simple MLC.
1. A computer-implemented method for employing a relatively simple machine learning classifier to explain evidence that led to a security action decision by a relatively complex machine learning classifier, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying training data;
training a relatively complex machine learning classifier (MLC) using the training data;
making a first security action decision using the relatively complex MLC, the first security action decision related to a potential security threat to a network device, the first security action decision comprising a decision that a network resource is likely malicious;
performing a security action on the network device, to mitigate the potential security threat, based on the first security action decision, the security action comprising at least partially blocking the network device from accessing the network resource;
training a relatively simple MLC using the training data;
making a second security action decision using the relatively simple MLC, the second security action decision being the same as the first security action decision;
extracting evidence values that led to the second security action decision by the relatively simple MLC, the extracting of the evidence values that led to the second security action decision comprising extracting relative priorities of different extracted evidence values, with the different extracted evidence values being divided into categories of values; and
explaining, using human-readable words for a user, the first security action decision by the relatively complex MLC using the evidence values extracted from the relatively simple MLC.
2. The method of claim 1 , wherein:
the network resource comprises a website; and
the at least partial blocking of the network device from accessing the network resource comprises blocking the network device from having access to the website.
3. The method of claim 1 , wherein:
the network resource comprises an application that is likely malicious; and
the at least partial blocking of the network device from accessing the network resource comprises at least partially blocking the network device from having access to a network.
4. The method of claim 1 , wherein:
the network resource comprises an extension application of a browser application of the network device is likely malicious; and
the at least partial blocking of the network device from accessing the network resource comprises at least partially blocking the extension application from sending data over a network.
5. The method of claim 1 , wherein:
the network resource comprises an email on the network device is likely malicious; and
the at least partial blocking of the network device from accessing the network resource comprises quarantining the email from being accessed by the network device.
6. The method of claim 1 , wherein the relatively complex MLC comprises one or more of a Support Vector Machine, an Artificial Neural Network, and a Deep Learning Network.
7. The method of claim 1 , wherein the relatively simple MLC comprises one or more of a Best-First Decision Tree, a C4.5 Tree, a Repeated Incremental Pruning to Produce Error Reduction (RIPPER), and a Fuzzy Unordered Rule Induction Algorithm (FURIA).
8. A computer-implemented method for employing a relatively simple machine learning classifier to explain evidence that led to a security action decision by a relatively complex machine learning classifier, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying training data;
training a relatively complex machine learning classifier (MLC) using the training data;
making a first security action decision using the relatively complex MLC, the first security action decision related to a potential security threat to a network device, the first security action decision comprising a decision that a network resource is likely malicious;
performing a security action on the network device, to mitigate the potential security threat, based on the first security action decision, the security action comprising at least partially blocking the network device from accessing the network resource;
training a relatively simple MLC using a subset of the training data; making a second security action decision using the relatively simple MLC, the second security action decision being the same as the first security action decision;
extracting evidence values that led to the second security action decision by the relatively simple MLC, the extracting of the evidence values that led to the second security action decision comprising extracting relative priorities of different extracted evidence values, with the different extracted evidence values being divided into categories of values; and
explaining, using human-readable words for a user, the first security action decision by the relatively complex MLC using the evidence values extracted from the relatively simple MLC.
9. The method of claim 8 , wherein the subset of the training data comprises fewer categories of training data.
10. The method of claim 8 , wherein the subset of the training data comprises a simplified subset of the training data.
11. The method of claim 8 , wherein the categories of values correspond to human-readable adjectives.
12. The method of claim 11 , wherein the explaining of the first security action decision comprises explaining the first security action decision using the human-readable adjectives.
13. One or more non-transitory computer-readable media comprising one or more computer-readable instructions that, when executed by one or more processors of one or more computing devices, cause the one or more computing devices to perform a method comprising:
identifying training data;
training a relatively complex machine learning classifier (MLC) using the training data;
making a first security action decision using the relatively complex MLC, the first security action decision related to a potential security threat to a network device, the first security action decision comprising a decision that a network resource is likely malicious;
performing a security action on the network device, to mitigate the potential security threat, based on the first security action decision, the security action comprising at least partially blocking the network device from accessing the network resource;
training a relatively simple MLC using the training data;
making a second security action decision using the relatively simple MLC, the second security action decision being the same as the first security action decision;
extracting evidence values that led to the second security action decision by the relatively simple MLC, the extracting of the evidence values that led to the second security action decision comprising extracting relative priorities of different extracted evidence values, with the different extracted evidence values being divided into categories of values; and
explaining, using human-readable words for a user, the first security action decision by the relatively complex MLC using the evidence values extracted from the relatively simple MLC.
14. The one or more non-transitory computer-readable media of claim 13 , wherein:
the network resource comprises one or more of a website, an application, an extension application of a browser application of the network device, and an email on the network device; and
the at least partial blocking of the network device from accessing the network resource comprises blocking the network device from having access to the website, at least partially blocking the network device from having access to a network, at least partially blocking the extension application from sending data over a network, and quarantining the email from being accessed by the network device.
15. The one or more non-transitory computer-readable media of claim 13 , wherein:
the relatively complex MLC comprises one or more of a Support Vector Machine, an Artificial Neural Network, and a Deep Learning Network; and
the relatively simple MLC comprises one or more of a Best-First Decision Tree, a C4.5 Tree, a Repeated Incremental Pruning to Produce Error Reduction (RIPPER), and a Fuzzy Unordered Rule Induction Algorithm (FURIA).
16. The one or more non-transitory computer-readable media of claim 13 , wherein:
the categories of values correspond to human-readable adjectives; and
the explaining of the first security action decision comprises explaining the first security action decision using the human-readable adjectives.