Machine learning data filtering in a cross-domain environment
Techniques for transferring data from a first domain to a second domain in a cross-domain environment are presented. The techniques can include accepting computer readable data in the first domain for transfer to the second domain, passing the computer readable data to a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious, passing the computer readable data to a second machine learning classifier at the first domain trained with at least malware files specific to the first domain, and transferring the computer readable data to a destination in the second domain.
1. A method of transferring data from a first domain to a second domain in a cross-domain environment, wherein the first domain and the second domain comprise separate security domains, the method comprising:
accepting computer readable data in the first domain for transfer to the second domain;
passing the computer readable data to a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious;
passing the computer readable data to a second machine learning classifier at the first domain trained with at least malware files specific to the first domain;
transferring the computer readable data to a destination in the second domain;
passing the computer readable data to a third machine learning classifier at the second domain trained with at least malware files publicly identified as malicious; and
passing the computer readable data to a fourth machine learning classifier at the second domain trained with at least malware files specific to the second domain.
2. The method of claim 1 , further comprising passing the computer readable data to at least one filter configured to filter computer files based on at least one of: malware file signatures, sandbox behavior, metadata, or normalization.
3. The method of claim 1 , wherein the malware files publicly identified as malicious comprise files of malware used to generate signatures for a signature-based malware detection system.
4. The method of claim 1 , wherein the malware publicly identified as malicious comprise files with well formed formats.
5. The method of claim 1 , wherein the malware files specific to the first domain comprise malformed files.
6. The method of claim 1 , wherein the malware specific to the first domain comprise camera data.
7. The method of claim 6 , wherein the camera data comprises camera control data.
8. The method of claim 1 , wherein the malware files specific to the first domain comprise command and control data.
9. The method of claim 1 , wherein the malware files specific to the first domain comprise audio sensor data.
10. The method of claim 1 , wherein the transferring the computer readable data to a destination in the second domain comprises transferring via a one-way data diode.
11. The method of claim 1 , wherein the interface is configured to accept computer readable data and pass it to at least the first machine learning classifier and the second machine learning classifier before passing the computer readable data to the second cross-domain environment via a one-way data diode.
12. A computer system for transferring data from a first domain to a second domain in a cross-domain environment, wherein the first domain and the second domain comprise separate security domains, the system comprising:
an interface at the first domain for accepting computer readable data in the first domain for transfer to the second domain;
a first machine learning classifier at the first domain trained with at least malware files publicly identified as malicious;
a second machine learning classifier at the first domain trained with at least malware files specific to the first domain;
wherein the interface is configured to accept computer readable data and pass it to at least the first machine learning classifier and the second machine learning classifier before passing the computer readable data to the second cross-domain environment;
a third machine learning classifier at the second domain trained with at least malware files publicly identified as malicious; and
a fourth machine learning classifier at the second domain trained with at least malware files specific to the second domain;
wherein the system is configured to pass the computer readable data to at least the third machine learning classifier and to the fourth machine learning classifier in the second cross-domain environment.
13. The system of claim 12 , further comprising at least one filter communicatively coupled to receive the computer readable data and configured to filter computer files based on at least one of: malware file signatures, sandbox behavior, metadata, or normalization.
14. The system of claim 12 , wherein the malware files publicly identified as malicious comprise files of malware used to generate signatures for a signature-based malware detection system.
15. The system of claim 12 , wherein the malware files publicly identified as malicious comprise files with well formed formats.
16. The system of claim 12 , wherein the malware files specific to the first domain comprise malformed files.
17. The system of claim 12 , wherein the malware files specific to the first domain comprise camera data.
18. The system of claim 17 , wherein the camera data comprises camera control data.
19. The system of claim 12 , wherein the malware files specific to the first domain comprise command and control data.
20. The system of claim 12 , wherein the malware specific to the first domain comprise audio sensor data.