Methods and apparatus for natural language interface for constructing complex database queries
In some embodiments, a processor receives, via an interface, natural language data associated with a user request for performing an identified computational task associated with a cybersecurity management system. The processor is configured to provide the natural language data as input to a machine learning (ML) model. The ML model is configured to automatically infer a template query based on the natural language data. The processor is further configured to cause the template query to be displayed, via the interface. The processor is further configured to receive, via the interface, user input indicating a finalized query associated with the identified computational task, and to provide the finalized query as input to a system configured to perform the identified computational task. The processor is further configured to modify a security setting in the cybersecurity management system based on the performance of the identified computational task.
1. An apparatus, comprising:
a memory; and
a processor operatively coupled to the memory, the processor configured to:
receive, via an interface, natural language data associated with a user request for performing an identified computational task associated with a cybersecurity management system;
provide the natural language data as input to a first machine learning (ML) model, the first ML model configured to automatically infer a template query based on the natural language data;
evaluate a performance of the first ML model;
generate a recommendation indicating a type of training data based on the performance;
train a second ML model to provide augmented training data, the augmented training data being the type of training data;
re-train the first ML model based on the augmented training data;
cause the template query to be displayed, via the interface, the template query being editable by a user;
receive, via the interface, user input indicating a finalized query associated with the identified computational task;
provide the finalized query as input to a system configured to perform the identified computational task; and
modify a security setting in the cybersecurity management system based on the performance of the identified computational task.
2. The apparatus of claim 1 , wherein the template query is a first template query, the processor configured to:
receive, via the interface, one or more edits made, by a user, to the first template query to generate a second template query; and
provide, as training input, the one or more edits, to the first ML model, the first ML model being trained to improve performance at inferring the second template query given the natural language data associated with the user request.
3. The apparatus of claim 1 , wherein the first ML model is configured to generate the template query by parsing the natural language data associated with a user request into a set of portions, each portion from the set of portions being associated with a parameter from a set of parameters, the processor configured to cause the display of the template query including the set of parameters via the interface.
4. The apparatus of claim 3 , wherein the processor is configured to cause the display of the set of parameters such that each portion from the set of portions is displayed as one option from a plurality of options associated with a parameter from the set of parameters, the processor configured to:
provide control tools, via the interface, the control tools configured to receive, from the user, a selection of at least one option from the plurality of options associated with each parameter from the set of parameters.
5. The apparatus of claim 1 , wherein the first ML model is configured to receive a partially complete portion of the natural language data associated with the user request for performing the identified computational task and automatically infer, based on the partially complete portion, at least a part of a remaining portion of the natural language data associated with the user request.
6. The apparatus of claim 1 , wherein the identified computational task is associated with implementing measures for malware detection and mitigation, the first ML model being trained to receive natural language data associated with a user request and automatically infer a corresponding template query based on training the first ML model using natural language data related to cybersecurity.
7. The apparatus of claim 6 , wherein the identified computational task includes at least one of blocking a communication or a host, applying a patch to a set of hosts, rebooting a machine, or executing a rule at an identified endpoint.
8. The apparatus of claim 6 , wherein the first ML model is configured to generate the template query by parsing the natural language data associated with the user request into a set of portions, each portion from the set of portions being associated with a parameter from a set of parameters, the set of parameters including at least one of an action parameter, an object parameter, or a descriptor parameter associated with the object parameter.
9. A method, comprising:
receiving, via an interface, a natural language request for performing an identified task in a cybersecurity management system;
parsing the natural language request into a set of portions to predict, using a first machine learning (ML) model, a template query based on the natural language request, the template query including the set of portions, each portion from the set of portions being associated with a parameter from a set of parameters;
evaluating a performance of the first ML model;
generating a recommendation indicating a type of training data based on the performance;
training a second ML model to provide augmented training data, the augmented training data being the type of training data;
re-training the first ML model based on the augmented training data;
displaying, via the interface, the set of portions of the template query, the interface configured to receive changes, provided by a user, to a portion from the set of portions of the template query to form a finalized query; and
providing the finalized query to the cybersecurity management system to implement the identified task.
10. The method of claim 9 , further comprising:
receiving an incomplete portion of the natural language request;
automatically predicting using the first ML model, based on the incomplete portion of the natural language request, a set of potential options, each option from the set of potential options providing a remaining portion of the natural language request; and
presenting, via the interface, the set of potential options to the user, the interface configured to allow the user to select at least one option from the set of potential options for providing a remaining portion of the natural language request.
11. The method of claim 9 , further comprising:
providing the changes to each portion from the set of portions of the template query to form a finalized query as training input to the first ML model, the training input configured to improve performance of the first ML model at inferring the finalized query based on the natural language request for performing the identified task.
12. The method of claim 9 , wherein the first ML model is configured to receive an incomplete portion of the natural language request, and based on the incomplete portion infer a context associated with the natural language request, the prediction of the template query being based on the inferred context.
13. A non-transitory processor-readable medium storing code representing instructions to be executed by a processor, the instructions comprising code to cause the processor to:
receive, via an interface, a first portion of a natural language request, the first portion of the natural language request indicating a context associated with a task to be performed via a management system;
provide, the first portion of the natural language request to a first machine learning (ML) model, the first ML model configured to predict from the first portion of the natural language request and the context, a set of options, each option from the set of options indicating a second portion of the natural language request to generate a complete natural language request;
invoke a display, via the interface, of the set of options as a selectable list;
receive, via the interface, a selection of an option from the set of options to generate a complete natural language request to perform an identified task;
provide the complete natural language request as an input to a second ML model;
generate, using the second ML model, a template query based on the complete natural language request, the template query configured to infer the task to be performed via the management system;
evaluate a performance of the second ML model;
generate a recommendation indicating a type of training data based on the performance;
train a third ML model to provide augmented training data, the augmented training data being the type of training data;
re-train the second ML model based on the augmented training data;
receive confirmation of the inferred task to be performed via the management system; and
implement the task via the management system.
14. The non-transitory processor-readable medium of claim 13 , wherein the second ML model is the same as the first ML model.
15. The non-transitory processor-readable medium of claim 13 , wherein the second ML model is different than the first ML model.
16. The non-transitory processor-readable medium of claim 13 , further comprising code to cause the processor to:
receive, from the second ML model, the template query including a set of portions forming the template query, each portion from the set of portions being associated with a parameter from a set of parameters, the second ML model configured to predict the set of parameters based on a context associated with the complete natural language request; and
display, via the interface, the template query including the set of portions forming the template query and the set of parameters.
17. The non-transitory processor-readable medium of claim 16 , further comprising code to cause the processor to:
invoke a display of the set of portions and the set of parameters such that each portion from the set of portions is displayed as a first option from a plurality of options associated with a parameter from the set of parameters, the interface configured to allow selection of a first option from the plurality of options associated with each parameter from the set of parameters;
receive changes to the template query, the changes being input as a selection of a second option from the plurality of options, the second option being different than the first option for at least one parameter from the set of parameters; and
generate a modified query based on the changes to the template query, the inferred task to be performed via the management system being based on the modified query.
18. The non-transitory processor-readable medium of claim 13 , wherein the first ML model or the second ML model is a transformer.
19. The non-transitory processor-readable medium of claim 13 , wherein the second ML model is trained on parsing natural language data obtained from a plurality of language corpuses, the code to cause the processor to generate the template query further comprising code to cause the processor to:
train the second ML model, using natural language data associated with potential actions performed for implementing cybersecurity, to receive a natural language phrase associated with a task to implement cybersecurity measures,
the code to cause the processor to provide the complete natural language request to the second ML model to generate a template query includes code to cause the processor to provide the complete natural language request to the second ML model to generate, based on the natural language phrase, the template query based on a set of parameters, the set of parameters including an action parameter associated with the cybersecurity measures.
20. The non-transitory processor-readable medium of claim 19 , wherein the action parameter associated with the cybersecurity measures includes at least one of blocking a communication or a host, allowing a communication, filtering a set of data, sorting a set of data, displaying a set of data, applying a patch, rebooting an endpoint, or executing a rule.