Graphics processing unit optimization
Methods, systems and computer program products are provided for optimizing resources privately. An initial information gain corresponding to an initial client embedding dataset is computed and a machine learning model is trained based on the initial client embedding data set to generate at least one initial attack path in the initial graph data. A second information gain corresponding to a second client embedding data set is computed. A difference between the first information gain and the second information gain is computed. The machine learning model is trained if the difference between the first information gain and the second information gain meets a predetermined threshold to generate at least one new attack path in the second graph data.
1 . A method for optimizing graphics processing unit (GPU) resources during machine learning training events while preserving siloed client data privately, comprising:
siloing initial graph data having a first structure representing information technology associated with an organization, wherein the information technology associated with the organization includes any one of (i) at least one on-premises resource, (ii) at least one third party service, (iii) at least one cloud computing service, (iv) a plurality of credentials associated with (i), (ii), (iii), or (v) any combination of (i), (ii), (iii) and (vi);
mapping, by an algorithmic framework processor, the first structure represented by the initial graph data to a second structure, the second structure having a lower dimension than the first structure and containing real numbers, thereby generating an initial client embedding data set;
computing, by an information gain processor, a first information gain corresponding to the initial client embedding data set, wherein the information gain is a scalar representation showing an amount of information diversity in a client embedding data set;
training, by a dedicated server including a graphics processing unit (GPU), a machine learning model based on the initial client embedding data set to generate at least one initial attack path in the initial graph data;
siloing updated graph data as second graph data having a third structure representing the information technology associated with the organization;
mapping, using the algorithmic framework processor, the third structure representing the second graph data to a fourth structure, the fourth structure having a lower dimension than the third structure and containing real numbers, thereby generating a second client embedding data set;
computing, using the information gain processor, a second information gain corresponding to the second client embedding data set;
computing, using a difference processor, a difference between the first information gain and the second information gain;
retraining, using the dedicated server, the machine learning model if the difference between the first information gain and the second information gain meets a predetermined threshold to generate at least one new attack path in the second graph data; and
awaiting for a next client embedding data set update if the difference between the first information gain and the second information gain does not meet the predetermined threshold, thereby preventing retraining.
2 . The method according to claim 1 , further comprising:
detecting any one or a combination of:
a change in the initial graph data,
a change corresponding to a node property, and
a relationship between two or more nodes.
3 . The method of claim 1 , further comprising:
scoring, by a scoring processor, the at least one initial attack path, thereby generating at least one scored initial attack path;
ranking, by a ranking processor, the at least one scored initial attack path, thereby generating a ranking of initial attack paths;
providing the ranking of new attack paths to a user interface;
scoring, by the scoring processor, the at least one new attack path, thereby generating at least one scored new attack path;
ranking, by the ranking processor, the at least one scored new attack path, thereby generating a ranking of new attack paths; and
providing the ranking of new attack paths to the user interface.
4 . The method of claim 3 , wherein the scoring is performed by:
measuring a utility of vulnerability associated with at least one node in the initial attack path.
5 . The method according to claim 1 , further comprising:
receiving, from a user interface, an update including attribute data related to any one of (i) at least one node represented by the initial graph data, (ii) at least one edge represented by the initial graph data, or (iii) combination of (i) and (ii); and
retraining, using the dedicated server, the machine learning model using the attribute data and the client embedding data set.
6 . The method according to claim 5 , wherein the retraining of the machine learning model using the attribute data and the client embedding data set occurs if the difference between the first information gain and the second information gain is less than a predetermined threshold.
7 . A system for optimizing graphics processing unit (GPU) resources during machine learning training events while preserving siloed client data privately, comprising:
a first siloed database stored in a memory and configured to silo initial graph data having a first structure representing information technology associated with an organization, wherein the information technology associated with the organization includes any one of (i) at least one on-premises resource, (ii) at least one third party service, (iii) at least one cloud computing service, (iv) a plurality of credentials associated with (i), (ii), (iii), or (v) any combination of (i), (ii), (iii) and (vi);
an algorithmic framework processor configured to map a first structure represented by the initial graph data to a second structure, the second structure having a lower dimension than the first structure and containing real numbers, thereby generating an initial client embedding data set;
an information gain processor configured to compute a first information gain corresponding to the initial client embedding data set;
a dedicated server including a graphics processing unit (GPU) configured to train a machine learning model based on the initial client embedding data set to generate at least one initial attack path in the initial graph data;
a second siloed database configured to silo second graph data having a third structure representing the information technology associated with the organization;
the algorithmic framework processor further configured to map the third structure representing the second graph data to a fourth structure, the fourth structure having a lower dimension than the third structure and containing real numbers, thereby generating a second client embedding data set;
the information gain processor further configured to compute a second information gain corresponding to the second client embedding data set;
a difference processor configured to compute a difference between the first information gain and the second information gain; and
the dedicated server further configured to retrain the machine learning model if the difference between the first information gain and the second information gain meets a predetermined threshold to generate at least one new attack path in the second graph data and to await for a next client embedding data set update if the difference between the first information gain and the second information gain does not meet the predetermined threshold.
8 . The system according to claim 7 , further comprising:
the user interface further configured to detect any one or a combination of:
a change in the initial graph data,
a change corresponding to a node property, and
a relationship between two or more nodes.
9 . The system of claim 7 , further comprising:
a scoring processor configured to score the at least one initial attack path, thereby generating at least one scored initial attack path;
a ranking processor configured to:
rank the at least one scored initial attack path, thereby generating a ranking of initial attack paths, and
provide the ranking of new attack paths to a user interface;
the scoring processor further configured to score the at least one new attack path, thereby generating at least one scored new attack path; and
the ranking processor further configured to:
rank the at least one scored new attack path, thereby generating a ranking of new attack paths, and
provide the ranking of new attack paths to the user interface.
10 . The system according to claim 9 , wherein the scoring processor is configured to perform scoring is by measuring a utility of vulnerability associated with at least one node in the initial attack path.
11 . The system according to claim 7 , further comprising:
a user interface configured to receive an update including attribute data related to any one of (i) at least one node represented by the initial graph data, (ii) at least one edge represented by the initial graph data, or (iii) combination of (i) and (ii); and
the dedicated server is further configured to retrain the machine learning model using the attribute data and the client embedding data set.
12 . The system according to claim 11 , wherein the retraining of the machine learning model using the attribute data and the client embedding data set occurs if the difference between the first information gain and the second information gain is less than a predetermined threshold.
13 . A non-transitory computer-readable medium having stored thereon one or more sequences of instructions for causing one or more processors to perform:
siloing initial graph data having a first structure representing information technology associated with an organization, wherein the information technology associated with the organization includes any one of (i) at least one on-premises resource, (ii) at least one third party service, (iii) at least one cloud computing service, (iv) a plurality of credentials associated with (i), (ii), (iii), or (v) any combination of (i), (ii), (iii) and (vi);
mapping the first structure represented by the initial graph data to a second structure, the second structure having a lower dimension than the first structure and containing real numbers, thereby generating an initial client embedding data set;
computing a first information gain corresponding to the initial client embedding data set, wherein the information gain is a scalar representation showing an amount of information diversity in a client embedding data set;
training a machine learning model based on the initial client embedding data set to generate at least one initial attack path in the initial graph data;
siloing updated graph data as second graph data having a third structure representing the information technology associated with the organization;
mapping the third structure representing the second graph data to a fourth structure, the fourth structure having a lower dimension than the third structure and containing real numbers, thereby generating a second client embedding data set;
computing a second information gain corresponding to the second client embedding data set;
computing a difference between the first information gain and the second information gain;
retraining the machine learning model if the difference between the first information gain and the second information gain meets a predetermined threshold to generate at least one new attack path in the second graph data; and
awaiting for a next client embedding data set update if the difference between the first information gain and the second information gain does not meet the predetermined threshold, thereby preventing retraining.
14 . The non-transitory computer-readable medium of claim 13 , further having stored thereon a sequence of instructions for causing the one or more processors to perform:
detecting any one or a combination of:
a change in the initial graph data,
a change corresponding to a node property, and
a relationship between two or more nodes.
15 . The non-transitory computer-readable medium of claim 13 , further having stored thereon a sequence of instructions for causing the one or more processors to perform:
scoring the at least one initial attack path, thereby generating at least one scored initial attack path;
ranking the at least one scored initial attack path, thereby generating a ranking of initial attack paths;
providing the ranking of new attack paths to a user interface;
scoring the at least one new attack path, thereby generating at least one scored new attack path;
ranking the at least one scored new attack path, thereby generating a ranking of new attack paths; and
provide the ranking of new attack paths to the user interface.
16 . The non-transitory computer-readable medium of claim 15 , further having stored thereon a sequence of instructions for causing the one or more processors to perform:
measuring a utility of vulnerability associated with at least one node in the initial attack path.
17 . The non-transitory computer-readable medium of claim 13 , further having stored thereon a sequence of instructions for causing the one or more processors to perform:
receiving an update including attribute data related to any one of (i) at least one node represented by the initial graph data, (ii) at least one edge represented by the initial graph data, or (iii) combination of (i) and (ii); and
retraining the machine learning model using the attribute data and the client embedding data set.
18 . The non-transitory computer-readable medium of claim 13 , wherein the retraining of the machine learning model using the attribute data and the client embedding data set occurs if the difference between the first information gain and the second information gain is less than a predetermined threshold.