Systems and methods for multi-instance learning-based classification for streaming inputs

An electronic device configured for multi-instance learning (MIL)-based classification of a streaming input, comprising:

• a memory;
• and
• a processor in communication with the memory, the processor configured to:
• receive a threshold quantity of instances of the streaming input over a period of time, wherein each instance comprises a portion of the streaming input, the streaming input comprises a webpage and the instances comprise executable streaming input blocks within the webpage, and wherein the threshold quantity of instances comprises less than a total quantity of instances of the streaming input;
• generate after receiving the threshold number of instances, and prior to executing the streaming input, a first classification result by applying feature vectors that are dynamically extracted from the received threshold number of instances to a first biased MIL model that is biased toward a first classification;
• generate, prior to executing the streaming input, a second classification result by applying the feature vectors to a second biased MIL model that is biased toward a second classification, wherein the first biased MIL model is biased opposite the second biased MIL model;
• wherein the extracted feature vectors are applied to the first biased MIL model and the second biased MIL model simultaneously for classification;
• use the generated first classification result and the generated second classification result to generate a classification value for the streaming input based on the subset of the received instances of the streaming input and before all of the instances of the streaming input are available at the electronic device;
• determine that the generated classification value is not accurate;
• in response to determining that the generated classification value is not accurate and prior to both executing the streaming input and receiving the total quantity of instances of the streaming input:
• update at least one of the generated first classification result and the generated second classification result using additional instances of the streaming input;
• and
• update the generated classification value using at least one of the updated first classification result and the updated second classification result;
• determine whether the streaming input is benign based on the updated classification value being accurate;
• and
• execute the benign streaming input in response to determining the updated classification value is accurate.

A non-transitory tangible computer readable medium having stored thereon processor-executable software instructions configured to cause a processor in an electronic device to perform operations for multi-instance learning (MIL)-based classification of a streaming input, the operations comprising:

• receiving, by a processor in an electronic device, a threshold quantity of instances of the streaming input over a period of time, wherein each instance comprises a portion of the streaming input, the streaming input comprises a webpage and the instances comprise executable streaming input blocks within the webpage, and wherein the threshold quantity of instances comprises less than a total quantity of instances of the streaming input;
• generating after receiving the threshold number of instances, by the processor prior to executing the streaming input, a first classification result by applying feature vectors that are dynamically extracted from the received threshold number of instances to a first biased MIL model that is biased toward a first classification;
• generating, by the processor prior to executing the streaming input, a second classification result by applying the feature vectors to a second biased MIL model that is biased toward a second classification, wherein the first biased MIL model is biased opposite the second biased MIL model;
• wherein the extracted feature vectors are applied to the first biased MIL model and the second biased MIL model simultaneously for classification;
• using, by the processor, the generated first classification result and the generated second classification result to generate a classification value for the streaming input based on the subset of the received instances of the streaming input and before all of the instances of the streaming input are available at the electronic device;
• determining, by the processor, that the generated classification value is not accurate;
• in response to determining that the generated classification value is not accurate and prior to both executing the streaming input and receiving the total quantity of instances of the streaming input:
• updating at least one of the generated first classification result and the generated second classification result using additional instances of the streaming input;
• and
• updating the generated classification value using at least one of the updated first classification result and the updated second classification result;
• determining, by the processor, whether the streaming input is benign based on the updated classification value being accurate;
• and
• executing, by the processor, the benign streaming input in response to determining the updated classification value is accurate.

An apparatus for multi-instance learning (MIL)-based classification for a streaming input, comprising:

• means for receiving a threshold quantity of instances of the streaming input over a period of time, wherein each instance comprises a portion of the streaming input, the streaming input comprises a webpage and the instances comprise executable streaming input blocks within the webpage, and wherein the threshold quantity of instances comprises less than a total quantity of instances of the streaming input;
• means for generating after receiving the threshold number of instances, prior to executing the streaming input, a first classification result by applying feature vectors that are dynamically extracted from the received threshold number of instances to a first biased MIL model that is biased toward a first classification;
• means for generating, prior to executing the streaming input, a second classification result by applying the features feature vectors to a second biased MIL model that is biased toward a second classification, wherein the first biased MIL model is biased opposite the second biased MIL model;
• wherein the extracted feature vectors are applied to the first biased MIL model and the second biased MIL model simultaneously for classification;
• means for using, the generated first classification result and the generated second classification result to generate a classification value for the streaming input based on the subset of the received instances of the streaming input and before all of the instances of the streaming input are available at the electronic device;
• means for determining that the generated classification value is not accurate;
• means for updating at least one of the generated first classification result and the generated second classification result using additional instances of the streaming input in response to determining that the generated classification value is not accurate and prior to both executing the streaming input and receiving the total quantity of instances of the streaming input;
• and
• means for updating the generated classification value using at least one of the updated first classification result and the updated second classification result in response to determining that the generated classification value is not accurate and prior to both executing the streaming input and receiving the total quantity of instances of the streaming input;
• means for determining, by the processor, whether streaming input is benign based on the updated classification value being accurate;
• and
• means for executing the benign streaming input in response to determining the updated classification value is accurate.