Learning from mistakes to improve detection rates of machine learning (ML) models
Systems and methods for learning from mistakes to improve detection rates of Machine Learning (ML) models. The systems and methods including receiving data with labels; running the data through a trained ML model for predictions; identifying errors in the predictions based on the labels received with the data; adjusting weights associated with samples in the data based on the identified errors; and retraining the ML model with the adjusted weights.
1 . A method for improving precision and recall (detection rates) of Machine Learning (ML) models for malware detection in a computing network environment, the method comprising steps of:
receiving data with labels identifying files, network flows, or executables as malicious or benign;
running the data through a trained ML model for predictions;
identifying errors in the predictions based on the labels received with the data, wherein the errors including false positives and false negatives;
performing error analysis to group error-causing samples by root-cause feature sets;
adjusting weights associated with samples in the data based on the identified errors, wherein adjusting comprises adding weight increments to error-causing samples and combining those increments with pre-existing fixed sample weights; and
retraining the ML model with the adjusted weights to improve subsequent malware detection performance in the cloud-based system.
2 . The method of claim 1 , wherein the ML model is adapted to detect malware in the received data comprising executable binaries, firmware images, or network packet payloads.
3 . The method of claim 1 , wherein higher weights are added to the samples in the data with prediction errors, and the added weights are scaled proportionally to a confidence-score of the error or distance from decision boundary.
4 . The method of claim 1 , wherein the labels received with the data identify the samples in the data as malicious or benign based on static analysis, dynamic execution, sandbox results, or threat intelligence feeds.
5 . The method of claim 1 , wherein the received data includes fixed weights associated with the samples in the data, and wherein added weights are added to the fixed weights for the adjusting, to address class imbalance between benign and malicious samples.
6 . The method of claim 1 , wherein the errors identified in the predictions include false positives and false negatives, and error analysis groups errors by shared feature clusters before weight adjustment.
7 . The method of claim 1 , wherein the steps further include upsampling the received data to rebalance malicious and benign samples prior to retraining.
8 . A cloud-based system for improving detection rates of Machine Learning (ML) models used in a computing network environment, the cloud based system comprising:
one or more processors and memory storing instructions that, when executed, cause the one or more processors to:
receive data with labels identifying files, network flows, or executables as malicious or benign;
run the data through a trained ML model for predictions;
identify errors in the predictions based on the labels received with the data, wherein the errors including false positives and false negatives;
perform error analysis to group error-causing samples root-cause feature sets;
adjust weights associated with samples in the data based on the identified errors, wherein the weights are adjusted by adding weight increments to error-causing samples and combining those increments with pre-existing fixed sample weights; and
retrain the ML model with the adjusted weights to improve subsequent malware detection performance in the cloud-based system.
9 . The cloud-based system of claim 8 , wherein the ML model is adapted to detect malware in the received data comprising executable binaries, firmware images, or network packet payloads.
10 . The cloud-based system of claim 8 , wherein higher weights are added to the samples in the data with prediction errors, and the added weights are scaled proportionally to a confidence-score of the error or distance from decision boundary.
11 . The cloud-based system of claim 8 , wherein the labels received with the data identify the samples in the data as malicious or benign based on static analysis, dynamic execution, sandbox results, or threat intelligence feeds.
12 . The cloud-based system of claim 8 , wherein the received data includes fixed weights associated with the samples in the data, and wherein added weights are added to the fixed weights for the adjusted weights, to address class imbalance between benign and malicious samples.
13 . The cloud-based system of claim 8 , wherein the errors identified in the predictions include false positives and false negatives, and error analysis groups errors by shared feature clusters before weight adjustment.
14 . The cloud-based system of claim 8 , wherein the steps further include upsampling the received data to rebalance malicious and benign samples prior to retraining.
15 . A non-transitory computer-readable medium comprising instructions for improving detection rates of Machine Learning (ML) models for malware detection in a computing network environment that, when executed, cause one or more processors to perform steps of:
receiving data with labels identifying files, network flows, or executables as malicious or benign;
running the data through a trained ML model for predictions;
identifying errors in the predictions based on the labels received with the data, wherein the errors including false positives and false negatives;
performing error analysis to group error-causing samples by root-cause feature sets;
adjusting weights associated with samples in the data based on the identified errors, wherein adjusting comprises adding weight increments to error-causing samples and combining those increments with pre-existing fixed sample weights; and
retraining the ML model with the adjusted weights to improve subsequent malware detection performance in the cloud-based system.
16 . The non-transitory computer-readable medium of claim 15 , wherein the ML model is adapted to detect malware in the received data comprising executable binaries, firmware images, or network packet payloads.
17 . The non-transitory computer-readable medium of claim 15 , wherein higher weights are added to the samples in the data with prediction errors, and the added weights are scaled proportionally to a confidence-score of the error or distance from decision boundary.
18 . The non-transitory computer-readable medium of claim 15 , wherein the labels received with the data identify the samples in the data as malicious or benign based on static analysis, dynamic execution, sandbox results, or threat intelligence feeds.
19 . The non-transitory computer-readable medium of claim 15 , wherein the received data includes fixed weights associated with the samples in the data, and wherein added weights are added to the fixed weights for the adjusting, to address class imbalance between benign and malicious samples.
20 . The non-transitory computer-readable medium of claim 15 , wherein the steps further include upsampling the received data to rebalance malicious and benign samples prior to retraining.