Machine learning process detection
View Patent ↗In some examples, the disclosure describes a device, comprising: a processor resource, and a non-transitory memory resource storing machine-readable instructions stored thereon that, when executed, cause the processor resource to generate a machine learning dataset, train and deploy a classifier using the machine learning dataset to determine whether a machine learning training process is running on a first computing device and whether the machine learning training process is malicious or is not malicious, and send an alert to the first computing device based on results of the trained classifier deployment on the first computing device.
1 . A device, comprising:
a processor resource; and
a non-transitory memory resource storing machine-readable instructions stored thereon that, when executed, cause the processor resource to:
generate a machine learning dataset, the generation comprising the processor resource to:
run first process and collect a first subset of the machine learning dataset;
run a second process and collect a second subset of the machine learning dataset;
run a third process and collect a third subset of the machine learning dataset; and
train and deploy a classifier using the machine learning dataset to determine whether a machine learning training process is running on a first computing device, and whether the machine learning training process is malicious or is not malicious; and
send an alert to the first computing device based on results of the trained classifier deployment on the first computing device.
2 . The device of claim 1 , further comprising the processor resource to:
deploy the trained classifier on a second computing device; and
send the alert to the second computing device based on results of the trained classifier deployment on the second computing device.
3 . The device of claim 2 , wherein:
in response to determining the machine learning training process running on the first computing device, the second computing device, or both is malicious, the processor is to send an alert to the first computing device, the second computing device, a third computing device, or a combination thereof; and
in response to determining the machine learning training process is not malicious, the processor is to instruct the first computing device, the second computing device, or both to continue to run the machine learning training process.
4 . The device of claim 3 , further comprising the processor resource to stop the machine learning training process in response to determining the machine learning process training process is malicious.
5 . The device of claim 2 , further comprising the processor resource to send an alert to the first computing device, the second computing device, or both, that the machine learning training process is running on the first computing device, the second computing device, or both, in response to determining the machine learning process is running on the first computing device, the second computing device, or both.
6 . The device of claim 1 , wherein the machine learning dataset comprises machine learning process metrics.
7 . The device of claim 1 , wherein the first process generates process metrics associated with a non-machine learning process, the second process generates process metrics associated with a malicious machine learning process, and the third process generates process metrics associated with a non-malicious machine learning process.
8 . The device of claim 1 , wherein the processor resource is to:
determine that the machine learning training process is running on the first computing device;
determine the first computing device is part of a network of computing devices; and
send an alert to each computing device in the network of computing devices that the machine learning training process is running on the first computing device.
9 . The device of claim 1 , wherein the processor resource is to:
determine that the machine learning training process is running on the first computing device and that the machine learning training process is malicious;
determine the first computing device is part of a network of computing devices; and
send an alert to each computing device in the network of computing devices that the machine learning training process is running on the first computing device and is malicious.
10 . A non-transitory memory resource storing machine-readable instructions stored thereon that, when executed, cause a processor resource to:
generate a dataset, the generation comprising the processor resource to:
run first process and collect a first subset of the dataset;
run a second process and collect a second subset of the dataset;
run a third process and collect a third subset of dataset; and
train, using the dataset, a classifier to determine whether a machine learning process running on a computing device is malicious;
deploy the trained classifier on the computing device to:
determine a first code running on the computing device is malicious;
determine a second code running on the computing device is not malicious; and
report the first code as malicious and the second code as not malicious to the computing device.
11 . The non-transitory memory resource of claim 10 , wherein the processor resource is to embed the trained classifier into the computing device or a different computing device using an integrated development environment (IDE) package.
12 . The non-transitory memory resource of claim 11 , wherein the processor resource is to rank items in the first code and the second code based on a determined relevance to the malicious determination, the non-malicious determination, or both.
13 . A device, comprising:
a processor resources; and
a non-transitory memory resource storing machine-readable instructions stored thereon that, when executed, cause the processor resource to:
generate a dataset, the generation comprising the processor resource to:
run a first process and collect a first subset of the dataset;
run a second process and collect a second subset of the dataset; and
run a third process and collect a third subset of the dataset;
train a first classifier using the dataset to determine whether a machine learning training process is running on a computing device;
deploy the trained first classifier on the computing device;
in response to determining the machine learning training process running on the computing device is malicious, deploy a second classifier trained using malicious training source code and non-malicious training source code, to scan code running on the computing device and determine what portion of the code is malicious; and
send results of the scan to the computing device.
14 . The device of claim 13 , wherein the processor resource is to send the results of the scan to a different computing device.
15 . The device of claim 13 , wherein the first process is a non-machine learning process, and the second process and the third process are machine-learning processes.