US 11,921,851 B1
System and method for improved end-to-end cybersecurity machine learning and deployment
Sai Omkar Vashisht, Morgan Hill, CA (US); Rahul Khul, Pune (IN); and Chunsheng Fang, Cupertino, CA (US)
Assigned to Musarubra US LLC, Plano, TX (US)
Filed by FireEye Security Holdings US LLC, Milpitas, CA (US)
Filed on Jan. 14, 2022, as Appl. No. 17/576,558.
Application 17/576,558 is a continuation of application No. 16/049,687, filed on Jul. 30, 2018, granted, now 11,227,047.
Claims priority of provisional application 62/692,345, filed on Jun. 29, 2018.
This patent is subject to a terminal disclaimer.
Int. Cl. G06F 21/55 (2013.01); G06F 21/56 (2013.01); G06N 20/00 (2019.01)
CPC G06F 21/554 (2013.01) [G06F 21/56 (2013.01); G06N 20/00 (2019.01); G06F 2221/034 (2013.01)] 20 Claims
OG exemplary drawing
 
1. A method, comprising:
generating a plurality of trained machine learning models, each trained machine learning model of the plurality of trained machine learning models trained to classify whether a digital resource is associated with a respective cyberattack of a plurality of cyberattacks;
selecting, based on a first performance metric, a first machine learning model and a second machine learning model from the plurality of trained machine learning models to operate in an in-line mode and a third machine learning model from the plurality of trained machine learning models to operate in an out-of-band mode,
the in-line mode being characterized by generating a first classification on whether the digital resource is associated with any cyberattack of the plurality of cyberattacks and using the first classification in determining remedial actions,
the out-of-band mode being characterized by generating a second classification on whether the digital resource is associated with any cyberattack of the plurality of cyberattacks and without using the second classification in determining a remedial action even when the second classification indicates an association with a cyberattack of the plurality of cyberattacks;
deploying, to one or more compute devices via a network, the first machine learning model, the second machine learning model, and the third machine learning model to classify a plurality of digital resources;
evaluating performance following execution of the first machine learning model, the second machine learning model, and the third machine learning model on the one or more compute devices; and
sending a signal to the one or more compute devices to change, in response to an evaluation that the third machine learning model outperforms the first machine learning model or the second machine learning model based on a second performance metric, a configuration of the first machine learning model or the second machine learning model from the in-line mode to the out-of-band mode and a configuration of the third machine learning model from the out-of-band mode to the in-line mode.