METHODS AND APPARATUS TO INCREMENTALLY TRAIN A MODEL

1 . An apparatus comprising:

at least one memory;

instructions; and

processor circuitry to execute the instructions to at least:

obtain first data from a first network device, the first data associated with a

first device class not previously associated with the processor circuitry;

build a vocabulary including keys that map to values for an incremental training batch, the incremental training batch based on the first data and exemplars from the at least one memory, the exemplars associated with a set of device classes previously associated with the processor circuitry, wherein the exemplars include first means closest to first overall means for ones of the set of the device classes that were stored to the at least one memory during a previous incremental training batch;

update the set of the device classes to include the first device class;

train a model based on the keys as input features and the updated set of the device classes;

select a set of samples from the first data and the exemplars, wherein the set of the samples include second means closest to second overall means for ones of the updated set of the device classes; and

update the exemplars in the at least one memory to correspond to the set of the samples for a subsequent incremental training batch.

2 . The apparatus of claim 1 , wherein the first data is text data, the text data corresponding to at least one of Universal Plug and Play (UPnP) data, multicast domain name system (mDNS) data, or domain name system (DNS) data.

3 . The apparatus of claim 1 , wherein the processor circuitry is to build the vocabulary by:

splitting the first data into words;

selecting a subset of the words to form the keys based on frequency of occurrence of the words in the first data; and

generating a hash map of the keys and the values, the keys being the subset of the words, the values indicating the frequency of occurrence of the subset of the words.

4 . The apparatus of claim 1 , wherein the processor circuitry is to update the exemplars in the at least one memory to correspond to the set of the samples to reduce monetary costs associated with data storage and data processing.

5 . The apparatus of claim 1 , wherein the second means include third means and fourth means, wherein the second overall means include a third overall mean and a fourth overall mean, wherein the processor circuitry is to further:

calculate the third overall mean and the fourth overall mean, the third overall mean based on first output vectors corresponding to first samples from the first data, the fourth overall mean based on second output vectors corresponding to second samples from the exemplars, the first samples associated with the first device class, the second samples associated with a second device class from the set of the device classes; and

calculate the third means and the fourth means, the third means corresponding to the first output vectors, the fourth means corresponding to the second output vectors.

6 . The apparatus of claim 5 , wherein the set of the samples includes a first subset of the samples and a second subset of the samples, the first subset of the samples including a first fraction of the first samples with third means closest to the third overall mean, the second subset of the samples including a second fraction of the second samples with fourth means closest to the fourth overall mean.

7 . The apparatus of claim 1 , wherein the processor circuitry is to update the exemplars in the at least one memory to correspond to the set of samples by:

matching words included in the set of the samples to a set of the keys;

determining a set of the values corresponding to the words; and

encoding the set of the samples to a sequence of numbers based on the set of the values.

8 . The apparatus of claim 7 , wherein the processor circuitry is to encode the set of the samples to prevent storing personally identifiable information.

9 . The apparatus of claim 1 , wherein the device classes correspond to at least one of device types, device manufacturers, and device model information.

10 . The apparatus of claim 1 , wherein the processor circuitry is to further implement the model to identify a second device class associated with second data corresponding to a second network device, the second device class from the updated set of device classes.

11 . The apparatus of claim 10 , wherein the processor circuitry is to further enforce security policies for the second network device based on the second device class.

12 . An apparatus comprising:

a vocabulary generator to:

obtain first data from a first network device, the first data associated with a

first device class not previously associated with the vocabulary generator;

build a vocabulary including keys that map to values for an incremental training batch, the incremental training batch based on the first data and exemplars from a memory, the exemplars associated with a set of device classes previously associated with the vocabulary generator, wherein the exemplars including first means closest to first overall means for ones of the set of the device classes were stored to the memory during a previous incremental training batch; and

update the set of the device classes to include the first device class;

a representation modifier to select a set of samples from the first data and the exemplars, wherein the set of the samples include second means closest to second overall means for ones of the updated set of the device classes; and

a model generator to:

train a model based on the keys as input features and the updated set of the device classes; and

update the exemplars in the memory to correspond to the set of the samples for a subsequent incremental training batch.

13 . The apparatus of claim 12 , wherein the first data is text data, the text data corresponding to at least one of Universal Plug and Play (UPnP) data, multicast domain name system (mDNS) data, or domain name system (DNS) data.

14 . The apparatus of claim 12 , wherein the vocabulary generator is to build the vocabulary by:

splitting the first data into words;

selecting a subset of the words to form the keys based on frequency of occurrence of the words in the first data; and

generating a hash map of the keys and the values, the keys being the subset of the words, the values indicating the frequency of occurrence of the subset of the words.

15 . The apparatus of claim 12 , wherein the model generator is to update the exemplars in the memory to correspond to the set of the samples to reduce monetary costs associated with data storage and data processing.

16 . The apparatus of claim 12 , wherein the second means include third means and fourth means, wherein the second overall means include a third overall mean and a fourth overall mean, wherein the model generator is to further:

calculate the third overall mean and the fourth overall mean, the third overall mean based on first output vectors corresponding to first samples from the first data, the fourth overall mean based on second output vectors corresponding to second samples from the exemplars, the first samples associated with the first device class, the second samples associated with a second device class from the set of the device classes; and

calculate the third means and the fourth means, the third means corresponding to the first output vectors, the fourth means corresponding to the second output vectors.

17 . The apparatus of claim 16 , wherein the set of the samples includes a first subset of the samples and a second subset of the samples, the first subset of the samples including a first fraction of the first samples with third means closest to the third overall mean, the second subset of the samples including a second fraction of the second samples with fourth means closest to the fourth overall mean.

18 . The apparatus of claim 12 , wherein the representation modifier is to update the exemplars in the memory to correspond to the set of the samples by:

matching words included in the set of the samples to a set of the keys;

determining a set of the values corresponding to the words; and

encoding the set of the samples to a sequence of numbers based on the set of the values.

19 . The apparatus of claim 18 , wherein the representation modifier is to encode the set of the samples to prevent storing personally identifiable information.

20 . The apparatus of claim 12 , wherein the device classes correspond to at least one of device types, device manufacturers, and device model information.

21 . The apparatus of claim 12 , further including a device identifier to implement the model to identify a second device class associated with second data corresponding to a second network device, the second device class from the updated set of the device classes.

22 . The apparatus of claim 21 , wherein the device identifier is to further enforce security policies for the second network device based on the second device class.

23 . A non-transitory computer readable medium comprising instructions that when executed cause at least one processor to:

obtain first data from a first network device, the first data associated with a first device class not previously associated with the at least one processor;

build a vocabulary including keys that map to values for an incremental training batch, the incremental training batch based on the first data and exemplars from a memory, the exemplars associated with a set of device classes previously associated with the at least one processor, wherein the exemplars including first means closest to first overall means for ones of the set of the device classes were stored to the memory during a previous incremental training batch;

update the set of the device classes to include the first device class;

train a model based on the keys as input features and the updated set of the device classes;

select a set of samples from the first data and the exemplars, wherein the set of the samples include second means closest to second overall means for ones of the updated set of the device classes; and

update the exemplars in the memory to correspond to the set of the samples for a subsequent incremental training batch.

24 . The non-transitory computer readable medium of claim 23 , wherein the first data is text data, the text data corresponding to at least one of Universal Plug and Play (UPnP) data, multicast domain name system (mDNS) data, or domain name system (DNS) data.

25 . The non-transitory computer readable medium of claim 23 , wherein the at least one processor is to build the vocabulary by:

splitting the first data into words;

selecting a subset of the words to form the keys based on frequency of occurrence of the words in the first data; and

generating a hash map of the keys and the values, the keys being the subset of the words, the values indicating the frequency of occurrence of the subset of the words.

26 - 33 . (canceled)