Security model training and threshold selection

A computer implemented method, comprising:

• based on training data that represents malicious and benign computing activity, automatically training a set of candidate models to identify malicious activity in a monitored computing system based on activity indicators obtained from the monitored computing system;
• based on test data that represents malicious and benign computing activity, automatically evaluating performance of each candidate model, of the set of candidate models, in identifying malicious activity;
• generating a candidate model performance metric corresponding to each candidate model based on the evaluation of each candidate model;
• selecting one of the candidate models based on the candidate model performance metrics, wherein the selected candidate model is configured to:
• generate a confidence score indicative of a confidence that input activity data represents malicious activity, and
• compare the confidence score to respective alert thresholds corresponding to a plurality of different urgency levels associated with the selected candidate model,
• based on the comparison, select one of the plurality of different urgency levels, and
• assign a malicious activity to the selected urgency level;
• automatically setting the respective alert thresholds of the selected candidate model by:
• for each particular urgency level of the plurality of different urgency levels,
• identifying an allowable number of false positive outputs for the particular urgency level, and
• identifying a confidence score threshold which produces no more than the allowable number of false positive outputs for the particular urgency level based on a binary search of confidence scores;
• and
• automatically deploying the selected candidate model to the alert generation computing system.

A computer implemented method comprising:

• automatically training, based on training data, a candidate model to:
• receive input activity data indicative of computing activity;
• generate a confidence score indicative of a confidence that the input activity data represents malicious activity;
• compare the confidence score to respective alert thresholds corresponding to a plurality of different urgency levels associated with the candidate model, wherein each urgency level is associated with a particular alert channel of a plurality of different alert channels;
• select one of the plurality of different urgency levels based on the comparison;
• select one of the alert channels based on the selected urgency level;
• generate an output that is indicative of a determination that the input activity data represents malicious activity and indicative of the confidence score;
• and
• send an alert representing the output using the selected alert channel;
• automatically setting the respective alert thresholds corresponding to the plurality of different urgency levels based on the training data;
• identifying a current production model currently deployed by an alert generation computing system in a runtime production environment,
• the current production model configured to generate an alert output indicating that activity data represents malicious activity in the runtime production environment and representing a confidence score indicative of a confidence that the activity data represents malicious activity;
• generating a current model performance metric that represents performance of the current production model in identifying malicious activity based on test data;
• generating a candidate model performance metric that represents performance of the candidate model in identifying malicious activity based on test data;
• selecting a best performing model based on the current model performance metric and the candidate model performance metric;
• and
• automatically deploying the best performing model to the alert generation computing system in the runtime production environment.