Dynamically optimizing performance of a security appliance

A method, comprising:

• receiving, by a device, a training object associated with updating a threat prediction model,
• the training object including information indicating that the training object is not malicious;
• identifying, by the device, a set of features associated with the training object;
• executing, by the device, a set of security functions on the training object to determine a set of threat scores associated with the set of security functions,
• a threat score, of the set of threat scores, corresponding to a security function of the set of security functions;
• determining, by the device and based on the set of threat scores and the information indicating that the training object is not malicious, a set of utility values associated with the set of security functions,
• a utility value, of the set of utility values, corresponding to a security function of the set of security functions, and
• each utility value, of the set of utility values, including information indicating how useful a corresponding security function, of the set of security functions, is in determining whether the training object is malicious;
• updating, by the device, the threat prediction model based on the set of features, the set of threat scores, and the set of utility values;
• identifying, by the device, a set of features associated with an unknown object;
• and
• performing, by the device, a security function selection procedure including:
• determining, by the device, a set of predicted threat scores associated with the unknown object based on providing information associated with the set of features and a current threat score for the unknown object as inputs to the updated threat prediction model,
• the current threat score being a default threat score when no security function has yet been executed on the unknown object;
• determining a set of predicted utility values associated with the set of security functions based on the set of predicted threat scores,
• a predicted utility value, of the set of predicted utility values, identifying a predicted degree of usefulness for a respective predicted threat score, of the set of predicted threat scores, associated with the unknown object and a respective security function;
• identifying, by the device and based on the set of predicted utility values, a particular security function, of the set of security functions, for execution on the unknown object;
• causing, by the device, the particular security function to be executed on the unknown object;
• updating, by the device, the current threat score to generate a revised current threat score based on the particular security function being executed on the unknown object;
• determining, by the device, whether to cause another particular security function to be executed on the unknown object based on whether the revised current threat score satisfies a threshold;
• and
• repeating, by the device, the security function selection procedure, using the revised current threat score as an input to the updated threat prediction model, to cause the other particular security function to be executed on the unknown object when the revised current threat score does not satisfy the threshold.

A non-transitory computer-readable medium storing instructions, the instructions comprising:

• one or more instructions that, when executed by one or more processors, cause the one or more processors to:
• receive a training object associated with updating a threat prediction model,
• the training object including information indicating that the training object is not malicious;
• identify a set of features associated with the training object;
• execute a set of security functions on the training object to determine a set of threat scores associated with the set of security functions,
• a threat score, of the set of threat scores, corresponding to a security function of the set of security functions;
• determine, based on the set of threat scores and the information indicating that the training object is not malicious, a set of utility values associated with the set of security functions,
• a utility value, of the set of utility values, corresponding to a security function of the set of security functions, and
• each utility value, of the set of utility values, including information indicating how useful a corresponding security function, of the set of security functions, is in determining whether the training object is malicious;
• update the threat prediction model based on the set of features, the set of threat scores, and the set of utility values;
• identify a set of features associated with an unknown object;
• and
• perform a security function selection procedure, where the one or more processors are to:
• determine a set of predicted threat scores associated with the unknown object based on providing information associated with the set of features and a current threat score for the unknown object as inputs to the updated threat prediction model,
• the current threat score being a default threat score when no security function has yet been executed on the unknown object;
• determine a set of predicted utility values associated with the set of security functions based on the set of predicted threat scores,
• a predicted utility value, of the set of predicted utility values, identifying a predicted degree of usefulness for a respective predicted threat score, of the set of predicted threat scores, associated with the unknown object and a respective security function;
• identify, based on the set of predicted utility values, a particular security function, of the set of security functions, for execution on the unknown object;
• cause the particular security function to be executed on the unknown object;
• update the current threat score to generate a revised current threat score based on the particular security function being executed on the unknown object;
• determine whether to cause another particular security function to be executed on the unknown object based on whether the revised current threat score satisfies a threshold;
• and
• repeat the security function selection procedure, using the revised current threat score as an input to the updated threat prediction model, to cause the other particular security function to be executed on the unknown object when the revised current threat score does not satisfy the threshold.