System and method for in-situ classifier retraining for malware identification and model heterogeneity

A computer implemented method for producing unique classification models for each of a plurality of enterprises, wherein each enterprise determines when computer readable files are malicious or benign based on a common parent classifier model and an enterprise-specific sample set, the method comprising:

• a. producing a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations;
• b. receiving, from a user, adjudication of one or more class determinations of the parent classifier over a plurality of samples from an enterprise-specific sample set evaluated by the one or more in-situ retraining system or systems;
• c. determining a minimum number of adjudicated samples required to initiate an in-situ retraining process;
• d. blending a feature vector representation of in-situ training and test sets with a feature vector representation of parent training and test sets or subset thereof to form a blended training set;
• e. conducting machine learning over the blended training set to create a new classifier model;
• f. evaluating the new classifier model and the parent classifier model using the blended training set and unlabeled samples not included in the blended training set;
• and
• g. electing whether to replace the parent classifier model with the new classifier model.

A non-transitory computer readable medium comprising instructions for batched, supervised, in-situ machine learning classifier for malware identification and model heterogeneity retraining that are executed to perform the following operations:

• a. producing a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations;
• b. receiving, from a user, adjudication of one or more class determinations of the parent classifier over a plurality of samples evaluated by the one or more in-situ retraining system or systems;
• c. determining a minimum number of adjudicated samples required to initiate an in-situ retraining process;
• d. blending a feature vector representation of in-situ training and test sets with a feature vector representation of parent training and test sets or subset thereof to form a blended training set;
• e. conducting machine learning over the blended training set to create a new classifier model;
• f. evaluating the new classifier model and the parent classifier model using the blended training set and unlabeled samples not included in the blended training set;
• and
• g. electing whether to replace the parent classifier model with the new classifier model.

A system for batched, supervised, in-situ machine learning classifier retraining for malware identification and model heterogeneity comprising a server that includes a processor and a memory that includes instructions for batched, supervised, in-situ machine learning classifier retraining that are executed to perform the following operations:

• a. producing a parent classifier model in one location and providing it to one or more in-situ retraining system or systems in a different location or locations;
• b. receiving by the processor, from a user, adjudication of one or more class determinations of the parent classifier over a plurality of samples evaluated by the one or more in-situ retraining system or systems;
• c. determining a minimum number of adjudicated samples required to initiate an in-situ retraining process;
• d. blending a feature vector representation of in-situ training and test sets with a feature vector representation of parent training and test sets or subset thereof to form a blended training set;
• e. conducting machine learning over the blended training set to create a new classifier model;
• f. evaluating the new classifier model and the parent classifier model using the blended training set and unlabeled samples not included in the blended training set;
• and
• g. electing whether to replace the parent classifier model with the new classifier model.