Explainability of an unsupervised learning algorithm outcome
AssigneeMcAfee, Inc.
InventorGerman Lancioni
Life of this patent
Estimating the term…
Abstract
There is disclosed in one example a malware analysis server, including: a hardware platform including a processor and a memory; a machine learning model; a store of known objects previously classified by the machine learning model; and instructions encoded within the memory to instruct the processor to: receive a test sample; apply the machine learning model to the test sample to provide the test sample with classified features; compute pairwise distances between the test sample and a set of known objects from the store of known objects; select a group of near neighbor samples from the set of known objects; select a group of far neighbor samples from the set of known objects; and generate an explanation for the test sample according to the near neighbor samples and far neighbor samples.
Claims20
A malware analysis server, comprising:
- a hardware platform comprising a processor circuit and a memory;
- a store of known objects previously classified by a machine learning (ML) model;
- and
- instructions encoded within the memory to instruct the processor to:
- receive a test sample;
- apply the ML model to the test sample to provide the test sample with classified features;
- compute pairwise distances between the test sample and a set of known objects from the store of known objects;
- select a group of near neighbor samples from the set of known objects;
- select a group of far neighbor samples from the set of known objects;
- and
- generate an explanation for the test sample wherein the explanation indicates that the test sample is similar to the to the near neighbor samples and different from the far neighbor samples.
One or more tangible, non-transitory computer readable storage media having stored thereon executable instructions to instruct a processor to:
- analyze a test sample via an unsupervised machine learning (ML) model;
- compute pairwise distances to select a set of near neighbors from a set of known objects according to similar features;
- compute pairwise distances to select a set of far neighbors from the set of known objects according to dissimilar features;
- and
- generate a meaning group explanation report from the near neighbors and far neighbors, wherein the meaning group explanation report indicates that the test sample is similar to the near neighbors and different from the far neighbors.
A computer-implemented method of analyzing a binary test sample object via comparison to known objects, comprising:
- analyzing the test sample via machine learning to classify the test sample;
- comparing the test sample to a large set of known objects comprising computing pairwise feature distances between the test sample and the known objects;
- selecting a set of near neighbor objects according to a minimum threshold for pairwise feature distance;
- selecting a set of far neighbor objects according to a maximum threshold for pairwise feature distance;
- and
- generating a human-readable explainability report for the classification, including indicating similarity to the near neighbor objects and difference from the far neighbor objects.
Dependencies are inferred from the claim text.