Learning of malicious behavior vocabulary and threat detection through behavior matching
In one embodiment, a device obtains input features for a neural network-based model. The device pre-defines a set of neurons of the model to represent known behaviors associated with the input features. The device constrains weights for a plurality of outputs of the model. The device trains the neural network-based model using the constrained weights for the plurality of outputs of the model and by excluding the pre-defined set of neurons from updates during the training.
1. A method comprising:
obtaining, by a device, input features for a neural network-based model;
pre-defining, by the device, a set of neurons of the model to represent known behaviors associated with the input features;
constraining, by the device, weights for a plurality of outputs of the model; and
training, by the device, the neural network-based model using the constrained weights for the plurality of outputs of the model, by including the pre-defined set of neurons in the neural network-based model, and by excluding the pre-defined set of neurons from being updated during the training.
2. The method as in claim 1 , wherein the weights for the plurality of outputs of the model are constrained to be binary or near-binary.
3. The method as in claim 1 , wherein the outputs represent malicious computer network conditions.
4. The method as in claim 1 , wherein the input features represent computer network events.
5. The method as in claim 1 , further comprising:
deploying, by the device, the trained neural network-based model for use to detect malicious computer network conditions in one or more computer networks.
6. The method as in claim 1 , wherein the neural network-based model comprises a generative adversarial network (GAN).
7. The method as in claim 1 , wherein the input features represent system log events.
8. The method as in claim 1 , wherein the input features represent code structures of an executable.
9. An apparatus, comprising:
one or more network interfaces to communicate with a network;
a processor coupled to the network interfaces and configured to execute one or more processes; and
a memory configured to store a process executable by the processor, the process when executed configured to:
obtain input features for a neural network-based model;
pre-define a set of neurons of the model to represent known behaviors associated with the input features;
constrain weights for a plurality of outputs of the model; and
train the neural network-based model using the constrained weights for the plurality of outputs of the model, by including the pre-defined set of neurons in the neural network-based model, and by excluding the pre-defined set of neurons from being updated during the training.
10. The apparatus as in claim 9 , wherein the weights for the plurality of outputs of the model are constrained to be binary or near-binary.
11. The apparatus as in claim 9 , wherein the outputs represent malicious computer network conditions.
12. The apparatus as in claim 9 , wherein the input features represent computer network events.
13. The apparatus as in claim 9 , wherein the process when executed is further configured to:
deploy the trained neural network-based model for use to detect malicious computer network conditions in one or more computer networks.
14. The apparatus as in claim 9 , wherein the neural network-based model comprises a generative adversarial network (GAN).
15. The apparatus as in claim 9 , wherein the input features represent system log events.
16. The apparatus as in claim 9 , wherein the input features represent code structures of an executable.
17. A tangible, non-transitory, computer-readable medium storing program instructions that cause a device to execute a procedure comprising:
obtaining, by a device, input features for a neural network-based model;
pre-defining, by the device, a set of neurons of the model to represent known behaviors associated with the input features;
constraining, by the device, weights for a plurality of outputs of the model; and
training, by the device, the neural network-based model using the constrained weights for the plurality of outputs of the model, by including the pre-defined set of neurons in the neural network-based model, and by excluding the pre-defined set of neurons from being updated during the training.
18. The computer-readable medium as in claim 17 , wherein the weights for the plurality of outputs of the model are constrained to be binary or near-binary.
19. The computer-readable medium as in claim 17 , wherein the outputs represent malicious computer network conditions.
20. The computer-readable medium as in claim 17 , wherein the input features represent computer network events.