Building a Machine Learning model without compromising data privacy

1. A non-transitory computer-readable storage medium having computer-readable code stored thereon for programming one or more processors to perform steps of:

obtaining file identifiers associated with files in production data, wherein the production data is live, real traffic that includes both benign and malicious data;

obtaining lab data from one or more public repositories of malware samples based on similarities of the file identifiers obtained from the live, real production data and the lab data;

deriving weights based on similarities of the production data and the obtained lab data; and

utilizing the derived weights and the obtained lab data as training data for training a machine learning process for classifying malware in the production data, wherein the training includes utilizing the derived weights for improving a recall of the machine learning process.

2. The non-transitory computer-readable storage medium of claim 1 , wherein the obtaining file identifiers is based on monitoring of users associated with the files, and wherein only the file identifiers are maintained in log data.

3. The non-transitory computer-readable storage medium of claim 1 , wherein the obtaining lab data includes samples from the one or more public repositories matching the corresponding file identifiers for the production data.

4. The non-transitory computer-readable storage medium of claim 1 , wherein the obtaining lab data includes selecting samples from the one or more public repositories that have features closely related to features of the production data.

5. The non-transitory computer-readable storage medium of claim 4 , wherein the features of the production data are determined based on dimension reduction, and wherein the corresponding samples are selected based on being centered in clusters of production data in resulting reduced dimensions.

6. The non-transitory computer-readable storage medium of claim 5 , wherein the dimension reduction includes parametric t-distributed Stochastic Neighbor Embedding (tSNE) and an autoencoder to learn representations of the production data.

7. The non-transitory computer-readable storage medium of claim 1 , wherein the files are executable files.

8. A server comprising:

one or more processors and

memory storing computer-executable instructions that, when executed, cause the one or more processors to

obtain file identifiers associated with files in production data, wherein the production data is live, real traffic that includes both benign and malicious data;

obtain lab data from one or more public repositories of malware samples based on similarities of the file identifiers obtained from the live, real production data and the lab data;

deriving weights based on similarities of the production data and the obtained lab data; and

utilize the derived weights and the obtained lab data as training data for training a machine learning process for classifying malware in the production data, wherein the training includes utilizing the derived weights for improving a recall of the machine learning process.

9. The server of claim 8 , wherein the file identifiers are obtained based on monitoring of users associated with the files, and wherein only the file identifiers are maintained in log data.

10. The server of claim 8 , wherein the lab data includes samples from the one or more public repositories matching the corresponding file identifiers for the production data.

11. The server of claim 8 , wherein the lab data includes selected samples from the one or more public repositories that have features closely related to features of the production data.

12. The server of claim 11 , wherein the features of the production data are determined based on dimension reduction, and wherein the corresponding samples are selected based on being centered in clusters of production data in resulting reduced dimensions.

13. The server of claim 12 , wherein the dimension reduction includes parametric t-distributed Stochastic Neighbor Embedding (tSNE) and an autoencoder to learn representations of the production data.

14. The server of claim 8 , wherein the files are executable files.

15. A method comprising:

obtaining file identifiers associated with files in production data, wherein the production data is live, real traffic that includes both benign and malicious data;

obtaining lab data from one or more public repositories of malware samples based on similarities of the file identifiers obtained from the live, real production data and the lab data;

deriving weights based on similarities of the production data and the obtained lab data; and

utilizing the derived weights and the obtained lab data as training data for training a machine learning process for classifying malware in the production data, wherein the training includes utilizing the derived weights for improving a recall of the machine learning process.

16. The method of claim 15 , wherein the obtaining file identifiers is based on monitoring of users associated with the files, and wherein only the file identifiers are maintained in log data.

17. The method of claim 15 , wherein the obtaining lab data includes samples from the one or more public repositories matching the corresponding file identifiers for the production data.

18. The method of claim 15 , wherein the obtaining lab data includes selecting samples from the one or more public repositories that have features closely related to features of the production data.

19. The method of claim 18 , wherein the features of the production data are determined based on dimension reduction, and wherein the corresponding samples are selected based on being centered in clusters of production data in resulting reduced dimensions.

20. The method of claim 15 , wherein the files are executable files.